Quandle

✓ Build passed✓ Tests passed✓ Deployed

Your build passed.What did it expose?

Quandle checks your live site after each deploy and comments on the pull request that caused a problem. Only when something is new.

Add it to your repoView on GitHub

A GitHub Action. Free, no signup, and your source code never leaves GitHub.

terminal · your-app
git push origin fix-checkout
Opening pull request #42 "Fix checkout total"
Deploy: building preview…
✓ Preview ready preview-42.your-app.dev
Quandle · checking preview-42.your-app.dev from the outside
✓ 14 scripts read
✓ headers, CORS, cookies
! source map is public /assets/index-3f9a.js.map
! /.env is readable 3 keys, values hidden
Compared with production: 2 new, 1 already there
quandlecommented on #42
This deploy exposed 2 new things.
CriticalEnvironment file readable at /.env3 keys, values hidden · qf_3f9a1c
HighSource map is public/assets/index-3f9a.js.map · qf_81c0de
Fix it with your agent: stop copying .env into the build output, turn off production source maps, rotate the 3 keys.
Checked by Quandle
git commit -am "Stop shipping .env and source maps"
git push
✓ Preview ready preview-42.your-app.dev
Quandle · 2 resolved, nothing new
quandleedited their comment on #42
Everything this comment flagged is fixed.
FixedEnvironment file readable at /.envfixed in b4e5f6a
FixedSource map is publicfixed in b4e5f6a
Checked by Quandle

Example with made-up data.

More is coming

We’re building a Quandle platform on top of the Action. Want early access when it opens? Leave your email.

One email when early access opens. Nothing else.

Add Quandle to a repo

Two clicks on GitHub. Free, no signup, no API key.

The exact file: .github/workflows/quandle.yml
# Quandle: checks every deploy from the outside and comments only when it exposed something new.
#
# This file works as-is. Two things to do in Vercel (other hosts: nothing):
#   1. Settings > Git: make sure GitHub deployments are created, or this never runs.
#   2. Settings > Deployment Protection > Protection Bypass for Automation: create a secret and save it
#      in this repo as VERCEL_AUTOMATION_BYPASS_SECRET. Without it, Vercel deploys come back "Not scanned".

name: Quandle

on:
  deployment_status:

permissions:
  # Proves which repo is calling the Quandle engine (no signup, no API key).
  id-token: write
  # One PR comment, updated in place.
  pull-requests: write
  # One "production exposures" issue, updated in place.
  issues: write
  # Find the PR for this commit, check the default branch, read .quandle-ignore.yml.
  contents: read

jobs:
  scan:
    # Only successful deploys start a job.
    if: >-
      github.event_name != 'deployment_status' ||
      github.event.deployment_status.state == 'success'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: quandle-ai/github_action@v1
        with:
          # Empty until you add the secret above; then Vercel deploys are scanned too.
          bypass-secret: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}