Five tools. Free to run. Your name and email, and the result is yours.

A short diagnostic that tells you whether a task is worth automating, and is willing to tell you no. Frequency, time per run, how many people touch it, what an error costs, how often the rules change, and whether the inputs are structured.

A task that runs twice a year and changes every time is a bad automation candidate, and a tool that will not say so is a brochure.

One page, printable, for the meeting where somebody is about to sign something. The questions to get answered before the build rather than during it.

It is the natural companion to Should I Automate It. Someone who scores "yes, automate it" should be handed this immediately.

Secrets handling, access control, logging, error paths, rollback, human review gates, evaluation and testing, and what happens when the model or the vendor changes underneath you.

This is the closest tool to the book, and it is the argument Cody already has.

A public GitHub repository URL. The scan runs in your browser straight against GitHub, so nothing is uploaded to us and nothing is retained. Committed secrets and API keys, tracked .env files, key and credential files, and gaps in the gitignore coverage. It also says plainly what it does not check.

The reason this one exists: during security work on our own client sites we found live administrator credentials and unused invite tokens publicly readable on the internet, because a storage helper defaulted to public. Real finding, real fix, our own property. That is exactly what this scans for.

Where your exposure probably sits across WCAG 2.1 AA, HIPAA, PCI DSS, SOX, CMMC and DFARS 252.204-7012, FERPA, COPPA, PIPEDA, GDPR, CCPA and CPRA, GLBA, SOC 2 and the EU AI Act, and who to ask about it.

Educational and directional. It will never tell you that you are compliant, because a tool that tells somebody they are fine and is wrong is the exact failure this firm exists to criticize.