Manifesto

A five-minute answer to a question that shouldn’t cost you your machine.

Fake recruiters and “take-home assignments” have quietly become a way to hand malware straight to the people building games and tools. This is the tool I wanted to exist the first time one landed in my inbox.

The interview that owns your laptop

Someone says they’re a recruiter, or a studio, or a client. They send a repo, a project file, or a document. “Just take a look and tell us what you’d change.” Opening it can be enough. An npm postinstall, a Unity editor script, a Blender or Maya scene, a Word or PDF wired to run something the moment it opens; all of it executes before you type a single command.

The person on the other end is counting on you being flattered, rushed, and not a security expert. That isn’t a fair fight, and antivirus was never built for it. You shouldn’t need a security background, or five days, to answer one question: a stranger sent me this. What happens if I open it?

Built for the people getting targeted first

The clearest wave of this hits games and creative work: engineers and artists sent a Unity, Blender, or Maya project by a “studio” that doesn’t exist. So that’s where this starts.

First

Game & creative devs

Unity, Blender and Maya projects, hand-crafted lures aimed at people who open scene files for a living.

Also

Every developer

Any take-home repo: npm hooks, VS Code tasks, dev containers, git hooks that fire on clone or open.

And

Anyone sent a document

A PDF or Office file from someone you’ve never met. The same trick, aimed at people who don’t write code at all.

The lure is universal, so the tool scales to everyone. What runs before you open it is the same question whether you make games or spreadsheets.

Your file barely touches our servers

  • It’s fingerprinted in your browser first. The bytes only leave your machine if we’ve never seen that exact content before.
  • If it does upload, it lands in temporary storage just long enough to be read once, then a storage-level rule deletes it automatically, with no human and no code that has to remember to.
  • What we keep is a content fingerprint and the findings, never your source. Short evidence snippets around a flagged line are the only exception, so the report can show you what it saw.
  • Everything runs on servers in the EU, under GDPR, never in the US.
  • The scanner itself doesn’t profile you and sets no tracking cookies of its own. How it’s funded is spelled out just below, in plain sight.
No account, no source kept, nothing to leak. The whole system is built so that no single part ever holds your raw file and a way to reach the internet at the same time.

Why it’s free, and how it stays that way

This isn’t a startup harvesting you, and it isn’t venture-funded. It’s one person and one small server. Free, because someone staring anxiously at a stranger’s zip shouldn’t have to pay, or sign up, to find out whether they’re about to be robbed. The tool is never the thing being sold.

But servers cost money, and someone has to pay for them. Two things keep the lights on, and neither one ever touches what you scan:

  • Donations. If it saved you a scare, a coffee helps cover the hosting. That’s the honest ask, and it comes first.
  • Ads. To keep this free, with no paywall and no login, the site may one day carry ads. They would live on the page, not inside the scanner: your file and its findings are never shared with an advertiser, and the results screen stays ad-free. I’m still choosing an ad partner that fits all of this, so nothing runs yet.

I’m being upfront because a security tool that hides how it makes money isn’t one you should trust. If donations ever cover the bills on their own, the ads never happen. Whatever pays for the servers, it never gets to see what you came here to check.

Found a false positive, have a question, or just want to tell me something? Email me at sam.alonso@gmail.com.

Manifesto v1.0 · last updated 31 July 2026