trenchcoat
Free · no sign-up
Website report · 2 h ago

rednest.tech

“RedNest — Autonomous AI code security scanning”

Template-written 23 evidence items Code reader analysed 38 scripts
What this means for you

RedNest only talked to its own servers while we watched.E1

  • An AI agent used the site and saw 0 of 2 claimed features working.E21E22E23E20
  • AI / agents: The Quick Scan docs say you need a GitHub sign-in to run a Deep Scan, and opening /dashboard/scans sent me to a GitHub sign-in page. The Get started flow also begins with 'Continue with GitHub', so I couldn't run a scan or a PR review.E21E22E23
  • A working app / platform: The quoted text comes from a static example on the homepage, a sample PR #418 finding with redacted details. That page labels it 'An example'. Any real PR review needs the GitHub app and a sign-in, which I couldn't do.E20E23
  • Also noticed, Lines-scanned counter changes: The 'lines of code scanned' counter showed 1,018,124 on the homepage and 1,018,134 on the Get started page a little later.E20E22
  • Tech check: the site claims a working app / platform, and its public page shows matching evidence.E18E13E14
  • Tech check: the site mentions ai / agents, but we found nothing behind it in what its public page loads.E17
  • We saw no known analytics or advertising services load on the first visit.E1
  • Its code still includes Vercel Analytics, which may switch on later (for example after you accept cookies or sign in).E10
  • 1 cookie was set in your browser, all by the site itself.E6

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Nothing found on the public page

AI / agents

“…hacker to your team. Secure your entire codebase with AI-powered Deep Scans, automated GitHub PR reviews and ac…”E17

No matching code, calls or services in what loaded for us.

Evidence found

A working app / platform

“…like redacted/redacted#418 · Add invoice download app/api/invoices/[id]/route.ts 11 export async function GET(re…”E18

Calls to its own backend: /api/stats, /api/eE13E14

Calls its own backend /api/stats, /api/eE13E14
Wallet code none seen
Contract calls in its code none seen
Talks to AI services none seen
Live connections none seen

The real tech may live elsewhere. This page links to: github.com/apps/rednestai · check the code github.com/CapSoftware/Sandchest · check the code

What the AI agent tried

An AI agent (claude-opus-5-5) used the site in our sandbox for 4 steps and saw 0 of 2 claimed features working. It can't connect a wallet, pay, sign or log in, so those features count as "couldn't test". What it reports is what it observed, not a verdict.

Couldn't test

AI / agents

The Quick Scan docs say you need a GitHub sign-in to run a Deep Scan, and opening /dashboard/scans sent me to a GitHub sign-in page. The Get started flow also begins with 'Continue with GitHub', so I couldn't run a scan or a PR review.E21E22E23

Couldn't test

A working app / platform

The quoted text comes from a static example on the homepage, a sample PR #418 finding with redacted details. That page labels it 'An example'. Any real PR review needs the GitHub app and a sign-in, which I couldn't do.E20E23

Also noticed

Things the agent saw along the way that aren't among the site's claims. Not counted above.

Noticed

Lines-scanned counter changes

The 'lines of code scanned' counter showed 1,018,124 on the homepage and 1,018,134 on the Get started page a little later.E20E22

Noticed

Token-gated scan allowance

The homepage says one free lifetime scan comes with a GitHub sign-in. It says holding at least 50,000 $NEST in a verified Solana wallet gives 50 scans per month, and checking that needs a wallet connection.E20

What it is

  • The Internet Archive has never saved this site, so it is probably new.E19
  • The site describes itself as: “AI-powered security scanning for GitHub repositories. One free lifetime scan, then $NEST holder access for eligible wallets—no recurring fia”E2
  • It's built with React and Next.js (common tools for building web apps).E8E9
  • In your browser it can copy text to your clipboard.E11
  • It has sections such as /docs, /sign-in and /get-started.E16
  • While loading, it called 2 endpoints on its own servers, such as /api/stats and /api/e.E13E14

Where your data goes

On a first visit the page only talked to its own servers (rednest.tech).

How key features work

Loading its content

Its content loads from its own API while you browse (/api/stats and /api/e).E13E14

/api/stats/api/e

Drawing and editing in the browser

The page draws and edits graphics in your browser using the canvas.E12

canvas

Measuring what you do

Visits and clicks are measured with Vercel Analytics (found in its traffic or its code).E10

Vercel Analytics

Saving data on your device

It saves data in your browser (sessionStorage), so some things persist between visits.E7

sessionStorage

Cookies and storage

Names only. We never store the values.

CookieSet forKeptWhose
sc_aidE6rednest.tech about 365 daysthe site

sessionStorageE7: sc_aid_hint

Pages and API calls

Pages it links to

//docs/sign-in/get-started

Endpoints

Called while loading (seen) or named in the code (code).

rednest.tech/api/statsseenE13
rednest.tech/api/eseenE14
/api/statscodeE15

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: RedNest — Autonomous AI code security scanning
page title · https://rednest.tech/
E2
Page description: AI-powered security scanning for GitHub repositories. One free lifetime scan, then $NEST holder access for eligible wallets—no recurring fiat subscrip
page description · https://rednest.tech/
E3
Site name: RedNest
page site_name · https://rednest.tech/
E4
Main heading: Add a hacker to your team.
page h1 · https://rednest.tech/
E5
29 request(s) to rednest.tech
types: 11 script, 10 image, 2 font
GET https://rednest.tech/ · script · 29 requests · network recording
E6
Cookie 'sc_aid' set for rednest.tech
kept for about 365 days
cookie sc_aid on rednest.tech · value not stored
E7
sessionStorage: 1 key(s) saved in your browser
sessionStorage keys: sc_aid_hint · values not stored
E8
React detected by the code reader (react-runtime)
confidence: medium
rednest.tech/_next/static/immutable/chunks/1h9xuhtiku1-c.js · “react-runtime” · the code reader
E9
Next.js detected by the code reader (next-runtime)
confidence: high
rednest.tech/ · “next-runtime” · the code reader
E10
Vercel Analytics found in the code
rednest.tech/ (page HTML) @ 1:4496 · “@vercel/analytics” · pattern scan
E11
Uses the browser ability: clipboard_write
can copy text to your clipboard
rednest.tech/_next/static/immutable/chunks/0w2qsumix0ikt.js @ 3:207 · “clipboard.writeText(” · pattern scan
E12
Uses the browser ability: canvas
draws graphics on a canvas
rednest.tech/_next/static/immutable/chunks/0w2qsumix0ikt.js @ 3:3031 · “getContext("2d"” · pattern scan
E13
The page called /api/stats on rednest.tech (GET)
GET https://rednest.tech/api/stats · fetch · network recording
E14
The page called /api/e on rednest.tech (POST)
POST https://rednest.tech/api/e · fetch · network recording
E15
Code reader found the endpoint /api/stats
how: call:fetch
rednest.tech/_next/static/immutable/chunks/0w2qsumix0ikt.js @ 3:7538 · “/api/stats” · the code reader
E16
11 links to pages on the same site
page links · https://rednest.tech/ · /, /docs, /sign-in, /get-started
E17
The site says: “…hacker to your team. Secure your entire codebase with AI-powered Deep Scans, automated GitHub PR reviews and ac…”
page text · https://rednest.tech/ · …hacker to your team. Secure your entire codebase with AI-powered Deep Scans, automated GitHub PR reviews and ac…
E18
The site says: “…like redacted/redacted#418 · Add invoice download app/api/invoices/[id]/route.ts 11 export async function GET(re…”
page text · https://rednest.tech/ · …like redacted/redacted#418 · Add invoice download app/api/invoices/[id]/route.ts 11 export async function GET(re…
E19
The Internet Archive has no saved copy of rednest.tech
page web archive · https://web.archive.org/web/*/rednest.tech
E20
Agent step 1: view
AI agent step 1 · view on /
E21
Agent step 2: go /docs/quick-scan
AI agent step 2 · go on /docs/quick-scan · page called POST rednest.tech/api/e
E22
Agent step 3: go /get-started
AI agent step 3 · go on /get-started · page called GET rednest.tech/, POST rednest.tech/api/e
E23
Agent step 4: go /dashboard/scans
AI agent step 4 · go on /sign-in · page called POST rednest.tech/api/e

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • The code reader hit its size budget on parts of 5 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id CTxJ9Lc3.