Evidence first.
Words second.

What we look for

• Where your data goes: every outside domain, grouped as analytics and tracking, advertising, payments, AI providers, crypto and wallets, sign-in, monitoring, consent, support, embeds, backend services, fonts and CDNs.
• What it's built from: frameworks, notable libraries and the browser abilities its code uses (storage, location, camera, live connections).
• Crypto specifics: wallet libraries, what it can ask your wallet to sign or approve, contract functions it calls by name, chains and addresses written into its code.
• Key features: sign-in, search, payments, live updates, AI, wallet flows, traced to the requests and code locations that show them.
• Tech check: for project sites we quote the tech the page claims (AI and agents, on-chain, wallets, trading bots, own chain or L2, staking, live data, an app) and show, next to each claim, the evidence we found in what the page loads: calls to AI services, wallet code, contract calls, its own backend, live connections. Where we find nothing we say exactly that, nothing on the public page, and never call a project fake or a scam. Servers, private code and separate apps are invisible to us, so read it as one strong signal, not a verdict.
• Apps: paste a github.com link to an open-source app. We read its source (dependencies and web addresses, with file and line) and download its official release to inspect the shipped program without ever running it: what it links, whether it can go online, start other programs or load code, and every web address built into it. Only repositories with an open-source licence; no uploads, no paid or closed software.
• Smart contracts: paste an address on Robinhood Chain, Base, BNB Chain or Ethereum to see what its owner can do (mint, pause, block wallets, change fees, replace the code), read from the public bytecode.
• Solana tokens: paste a token's mint address to see which powers are still left on it (mint new tokens, freeze wallets, change the name and logo, and Token-2022 extras like transfer fees, a permanent delegate or a transfer hook), read straight from the chain, plus holder spread from GeckoTerminal.
• Every graduate, automatically: when a pump.fun coin completes its bonding curve and moves to a real pool, we check its token and, if it lists a website of its own, scan that too. It all shows up on the live feed and on a page per coin with the creator wallet's other coins.
• Wallet buttons: many sites only load their wallet code when you press "Connect wallet", so we press that one button (and nothing else). We never pick a wallet, sign or send anything.

What we never do

• No logins, no paywalled or members-only pages, no private or internal addresses.
• No file or app uploads yet. Analysing binaries is planned for a later version, behind terms of use.
• No cracking, piracy, licence or DRM bypass. We refuse those requests, and REA's own disclaimer forbids them.
• We never publish a site's source code: only behaviour, domain names and short identifiers such as endpoint or function names.
• We describe what code does, not what people intend. We never call anyone a scam, and nothing here is financial advice.

Engines on this server

Limits

Server-side logic is invisible from outside: we see what a browser sees. Most site code is minified, so names are partly lost and very large bundles are only partly analysed. Some trackers load only after you accept cookies or log in. Contract powers are read from function selectors; powers hidden behind unnamed functions can be counted but not explained.