Security audit for the code your AI assistant writes — here, or inside the assistant.

We look for the vulnerabilities that turn a data breach into a headline — injection flaws, broken authentication, exposed secrets, and gaps in how your APIs and infrastructure protect themselves. Every finding points to the exact file and line, with a fix.

module security · priority tier Core · Claude-reasoned · findings land under Security

We check how your app collects, stores, and hands off personal data — consent, data governance, audit trails, and readiness for the regulations that actually apply to you, including GDPR, CCPA, HIPAA, PCI DSS, and SOC 2.

module privacy · priority tier Core · Claude-reasoned · findings land under Privacy & Compliance

We look at what happens when something goes wrong — a crash, a dropped connection, a bad deploy — and whether your app recovers gracefully or takes your users down with it. Backups, failover, and fault tolerance all fall here.

module reliability · priority tier Core · Claude-reasoned · findings land under Reliability & Resilience

We read your codebase the way a senior engineer would on day one: is it organized, is it readable, and how much will the next feature cost to build on top of it. This is where technical debt gets named.

module code_quality · priority tier Important · Claude-reasoned · findings land under Code Quality & Architecture

AI-generated code has its own failure modes — confident-looking placeholder logic, hallucinated APIs, copy-pasted duplication, and edge cases nobody thought to handle because nobody wrote the code by hand. We look specifically for these.

module ai_risk · priority tier Important · Claude-reasoned · findings land under AI / Vibe Coding Risk

We look at what slows your app down under real load — inefficient queries, missing caching, wasted memory, and anything that gets more expensive as you grow.

module performance · priority tier Important · Claude-reasoned · findings land under Performance & Scalability

We check the machinery that gets your code into production and keeps it there — your CI/CD pipeline, container and infrastructure setup, environment separation, and how secrets are managed through their whole lifecycle.

module devops · priority tier Important · Claude-reasoned · findings land under Infrastructure & DevOps

We look at your data layer for the mistakes that are hardest to undo — unsafe migrations, missing constraints, unencrypted sensitive fields, and transaction handling that can silently corrupt data.

module data · priority tier Important · Claude-reasoned · findings land under Data Layer

We step back and ask the practical questions a founder or investor would: is this ready to run a real business on, what does it actually cost to keep alive, and where are you locked into a vendor or a license you didn't mean to take on.

module business · priority tier Supporting · Claude-reasoned · findings land under Business & Product Risk

We check how easy your own repository is to work in — local setup, build reproducibility, onboarding a new engineer, and the release process. A repo that's painful to develop in slows down everything else.

module devex · priority tier Supporting · Claude-reasoned · findings land under Developer Experience

We check whether your app is usable by everyone — screen-reader and keyboard support, responsive layouts, clear error messaging, and basic internationalization and browser-compatibility gaps.

module accessibility · priority tier Supporting · Claude-reasoned · findings land under Accessibility & UX

We check whether you'd actually notice if something broke — logging, metrics, tracing, and alerting that gets a human to the right place before your users notice first.

module observability · priority tier Supporting · Claude-reasoned · findings land under Observability

We take a forward-looking view: how much of this codebase depends on one person's memory, how expensive a future rewrite would be, and whether this is something you can keep maintaining a year from now.

module maintainability · priority tier Specialized · Claude-reasoned · findings land under Maintainability Forecast

We flag the genuinely novel ideas in your codebase — algorithms, architectures, or methods worth protecting — and check two separate ways they can leak: through a public repository, and through public-facing copy (README, docs, marketing) that spells out how something works rather than just what it does. This is an independent signal and never affects your production verdict.

module ip_exposure · priority tier Specialized · Claude-reasoned · findings land under IP & Novelty Exposure

A focused pass on GDPR readiness: whether you have a lawful basis for the personal data you collect, real consent flows, a clear picture of where personal data lives, a working path to honor deletion and data-subject-rights requests, and a plan for cross-border transfers and breach notification. Findings here are grouped with the broader Privacy & Compliance check. nittim runs this automatically when a repository shows signs of handling personal data.

Run /selfcheck’s 13 categories with your own assistant — you give us nothing. It wrote the code, so it may repeat its own blind spots; an independent judge catches those, and that’s what we sell.

Read real scans of well-known public code in /library before nittim sees a line of yours. Nothing to take on faith.

No AI in the free scan. Two deterministic scanners read the files and build the report. A test fails the build if source text reaches the database — a property of the code, not a promise.

BYOK Pro — API, MCP, or GitHub Action: the call runs on your key, under your vendor terms. nittim's model account never sees your code — check your own Anthropic bill.

Held in memory for the audit, never trained on, discarded after. The one rung that asks you to take nittim's word for it — last on purpose.

Built, both halves ran end to end, and it runs in your account — no source, finding or repo name reaches nittim. Not self-serve: we set it up with you on request. Images aren’t signed yet — verify by published hash.