01
The host you prove
A security scan starts after a DNS TXT record or a well-known file shows the host is yours. The scan stays on that host, refuses private addresses, and asks again before a production run.
MenuClose
[ 02 / 05 ]
About the scanner
Routelint is a self-hosted control plane for route exposure. It watches a running app, records the calls the interface makes, and checks that those calls stay with the account that made them.
What it is
Test suites for vibe-coded apps.
Teams ship interfaces quickly and leave API handlers behind them. Routelint treats that live interface as the spec: if the UI called it, the suite can replay it.
What you bring
A host you control, and two accounts.
Anonymous traffic is recorded on its own. User A and a peer account show whether one session can read another session’s objects. Credentials stay encrypted at rest.
Who it is for
Builders who need a check before the app is public.
Routelint fits a small team running its own Next.js, Rails, or any app that talks to JSON APIs from the browser. It is the place those checks live, next to the targets you already operate.
Product teams
See which routes the new UI opened, and which of them still answer without a session.
Founders shipping fast
Run the same five suites after each deploy instead of assembling a one-off script.
Security-minded engineers
Review redacted evidence, suppress noise, and keep production scans opt-in.
How the work is kept small
Four limits on every scan.
The scanner is useful because it refuses work it was not given. These are the boundaries around capture, replay, and storage.
02
Read-only by default
Replays use GET, HEAD, and OPTIONS. POST, PUT, and DELETE are cataloged from the observed response and are not sent again.
03
Redacted evidence
Emails, phone numbers, cards, JWTs, and password hashes are removed before a captured call or finding is stored.
04
One account, one surface
Targets, identities, scans, and findings belong to the signed-in account. A missing target answers as not found.
Contact
Questions about a scan.
Routelint does not send mail from the product. The docs describe how a scan runs, what it refuses, and how to read a result.