Weprax
Tooling for understanding code you did not write, including the code a model wrote for you.
- Python
- FastAPI
- Next.js
- TypeScript
Repository private pending patent review.
What it is
AI coding tools now produce more code per hour than a person can read. The code usually runs, which makes it look finished, and the reviewer is left unable to answer basic questions about it. What does this structure do? Are there credentials in it? Which dependencies did it pull in? Review capacity has not grown at the rate code generation has, and the same problem arrives without AI whenever someone inherits an unfamiliar repository.
Weprax takes a repository or a proposed change and helps a person assess it: inspect the code, surface what matters, explain findings in plain language, and leave a traceable record of what was checked. It is not built to replace human review but to make it structured and evidenced.
Phase 3 is complete. It can import a project from an archive, a public repository or a folder, identify the files and technologies in use with evidence for each, and clean up its temporary copy. There is no scanner and no risk score yet, and the interface still uses demonstration data for everything later phases will build. The README says so in its own status block, which is the discipline worth noticing.
Decisions worth defending
- Phased build with an explicit, published status line separating what exists from what is planned
- Safe project intake from archive, public repository or local folder, with temporary copies cleaned up
- Technology and file identification that cites its evidence rather than asserting a result
- A written threat model maintained alongside the product requirements
Not built yet
Planned work, with the reason it is next. None of this exists today.
Secret and dependency inspection
The first two questions anyone asks about generated code are whether it hard-coded a credential and what it pulled in. Neither is answerable today.
Normalized findings and a PASS / REVIEW / BLOCK recommendation
A reviewer needs one consistent format and a defensible recommendation, not raw output from several detectors.
Evidence suitable for ITGC and SOC-style review
A record of what was checked and when is the part an auditor actually needs, and it is cheap to produce if designed in early.