Every app hides
a blueprint.
Paste a link. We open it in a sealed browser, read its code with open-source reverse engineering, and tell you in plain words who it talks to, what it keeps and what it can ask your wallet to sign.
Real output.
Not a mockup.
www.theguardian.com talked to 177 outside services on a first visit, including 81 that measure visits or show ads.
- Before you click anything, the page loads analytics or ad services: Adobe Analytics, Cloudflare Web Analytics, Comscore, Permutive, Quantcast and 22 more.
- 200 cookies were set in your browser, 177 of them by other companies' domains.
{
"id": "E391",
"label": "React found in the code",
"where": "assets.guim.co.uk/assets/framew...:2",
"engine": "pattern scan"
}
Four steps.
About a minute.
Open it sealed
A fresh headless browser loads the public page in a sandbox. No login, no cookies accepted, no clicks.
Record everything
Every request, cookie name and storage key the page creates, and every outside domain it contacts.
Read the code
REA reads the site's own JavaScript: endpoints, routes, frameworks, wallet calls, each with file and line.
Say it plainly
The writer turns those facts into short sentences. Anything it can't back with evidence is deleted.
Recently revealed.
USDC on Base: the code has 5 control switches that can still be used.
Website
Website · 2 h ago
www.duolingo.com
Duolingo talked to 20 outside services on a first visit, including 10 that measure visits or show ads.
Website
Website · 2 h ago
app.uniswap.org
app.uniswap.org talked to 9 outside services on a first visit.
Website
Website · 2 h ago
excalidraw.com
Excalidraw talked to 4 outside services on a first visit, including 2 that measure visits or show ads.
Website
Website · 2 h ago
www.theguardian.com
www.theguardian.com talked to 177 outside services on a first visit, including 81 that measure visits or show ads.
What does it do with you?
Paste a link. About a minute later you'll see who it talks to, what it stores, and what it can ask your wallet to sign.
Reveal an app