How it works

You hand over a task. It comes back as a readout.

You drop something a recruiter or company sent you. beforeyoutask tells you what would run if you opened it, and never runs any of it to find out.

The four things that happen

You hand it over

Drop a .zip or .tar.gz, paste a public repo URL, or paste a single manifest. Files are fingerprinted in your browser first, if we’ve seen that exact content before, the bytes never leave your machine.

It’s opened in a sealed chamber

Your archive is unpacked and read inside a locked-down sandbox with no network and no way to write anywhere it shouldn’t. Nothing inside is ever executed, every file is treated as text to be read, not code to run.

Everything that auto-runs is inventoried

beforeyoutask looks for the things that execute without you asking, the hooks that fire when you download, open, install, or build. Each one is written up in plain language.

The readout streams back

Findings appear as each layer finishes, grouped by when they’d run rather than by a vague severity score.

A clean result is not a promise

There is deliberately no “safe”. A clean scan means no known indicator matched, not that the file is harmless. beforeyoutask shows you what it checked, so you can see the edges of what it can and can’t know. For the four rungs and a worked example, see What it examines.

What it is, and isn’t

beforeyoutask answers one question: a recruiter or company sent me this, what happens if I open it? It’s built for the developer or artist who just got a “take-home assignment” and has five minutes and no security background.

It is not an antivirus, and not a dependency-vulnerability scanner.
It never executes anything you give it.
It reports what auto-runs; it doesn’t judge whether your code is “good”.
When something is genuinely clean, it says so plainly instead of inventing a scare.

Two zones that never overlap

No single part ever holds your raw file and a way to reach the internet at the same time. The component that can see your untrusted file can’t phone home, and the one that can reach the network never sees your file.

Fetcher

network · target only

When you submit a URL, this resolves and downloads it, with guards against being tricked into reaching internal addresses. It sees links, never the analysis.

Analyzer

network · none

Opens and reads your archive inside a sealed container, read-only, unprivileged, resource-capped, no network at all. Bytes go in; a list of findings comes out. Nothing else crosses the wall.

Principles that don’t bend

Never executed

Read, not run

Static analysis only. The analyzer runs with the network switched off, not filtered, absent.

Deterministic

Rules decide the verdict

Deterministic rules set the outcome, and nothing else can overrule them, repo content is assumed hostile and never gets a vote.

Privacy

Hashes, not source

We keep a content fingerprint and the findings. No column anywhere holds your source; short evidence snippets are the only exception.

Reproducible

Same content, same result

Identical content always produces the same result, which is what makes content-hash caching trustworthy.