Scan project

Untitled scan

0 findings · risk 0/100 · 0% verified

What to scan

Surfaces

How it works

Set your target. Choose your project, URL, environment, and authorized scope.
Run the checklist. Pick the surfaces you own and verify grouped checks.
Log findings. Add severity, evidence, impact, and a recommended fix.
Ship the report. Compile Markdown, JSON, or HTML for your developers.

Privacy & safety

Scan data stays in this browser. There is no account, telemetry, or analytics.
Run only against targets you own or are explicitly authorized to test.
Use forks, read-only calls, simulations, and test wallets. Never move production funds.
Network requests happen only when you run a configured smoke check.

One lens over every attack surface in your project.

ErrorLens turns research-grade security frameworks into a guided checklist for your dApp, API, mobile app, and LLM features — then compiles a developer-ready report. Everything runs locally in your browser. Nothing leaves your machine.

Fork-only verification
Never moves funds
Private disclosure by default
Local-first, zero telemetry

errorlens scan --surfaces wallet,evm,llm

$ errorlens scan --all

[ HIGH ] Stale approval calldata after route change

[ MED ] Indirect prompt injection via fetched content

[ MED ] Untrusted writable account in tx assembly

117 checks · 3 findings · risk 46/100

A live-compiled report as you scan. Local-first — nothing leaves this browser.

What it scans

Eight surfaces, one workflow

Every surface ships a research-grade checklist — grouped, explainable, and founder-readable.

How it works

From target to report in four steps

1

Set your target

Project, URL, environment, chains, and what you are authorized to test. Defaults are safe: fork and read-only.

2

Run the checklist

Pick the surfaces you own. Work through grouped checks with plain-language and technical hints, then log findings.

3

Log what you find

Each finding captures severity, status, reproduction, evidence, impact, and a developer-ready recommendation.

4

Ship the report

Compile a Markdown report your developers can act on — copy it, download it, or export it as JSON.

Built on research frameworks

The severity model behind every finding

Honest severity is the discipline. Each level has a definition you can defend.

Step 2 of 4

Set your audit target

Defaults are safe. Authorize precisely what you intend to test — never more.

Scan project

Step 3 of 4

Run the checklist

Pick the surfaces you own, then work through the grouped checks. Checked items you cannot verify are logged automatically as test gaps.

Live probes

Smoke checks

Enter a target URL and RPC, then run lightweight client-side probes. Results that a browser cannot observe are labeled honestly as unknown.

Also check security headers

Need a CORS proxy for header reads? (optional)

CORS proxy

Framework checklist

Guided checks

0 / 0

Custom

Your own checks

Reusable checklists for internal tools, vendor integrations, or project-specific risks. Stored locally in this browser.

Step 4 of 4

Review and ship the report

Compile a Markdown report your developers can act on. Your data never leaves this browser.

Distribution

Findings by severity

Risk

0

Editorial

Positive observations & test gaps

Positive observations (what was done well — engineers need this too) Test gaps & follow-up checks

Session

Findings

0

Compile

Markdown output

This report updates live as you scan — coverage, findings, and smoke results are explained as you go. Press Compile report for a final refresh before copying or exporting.

Legal

Terms & Conditions

Effective 2026-08-10 · Last updated 2026-08-10

1. What ErrorLens is

ErrorLens is a local-first security scanning tool that runs entirely in your browser. It provides guided checklists, smoke probes, and report compilation to help you review web3 apps, APIs, mobile apps, and LLM features. It is not a hosted service and stores no data on our servers.

2. Authorized use only

Only run scans against targets you own or have explicit written authorization to test. Never use the tool to attack production systems, bypass rate limits, exfiltrate data, drain funds, or execute destructive transactions. ErrorLens is a verification aid — findings should be confirmed with fork, read-only, or simulated evidence before any claim is made.

3. Local data & privacy

Scan state, findings, and settings are stored in your browser's localStorage. There is no account, no telemetry, and no third-party analytics. Network requests are made only when you run smoke checks, and only to the target URL, RPC endpoint, or CORS proxy you configure. Optional AI drafting sends the finding title, severity, surface, and area to the OpenAI-compatible endpoint and key you provide — only when you click "Draft with AI".

4. No warranty

ErrorLens is provided "as is" without warranty of any kind. Checklists and automated probes are guidance, not proof. A clean scan does not guarantee a target is secure, and ErrorLens is not a substitute for a professional security audit by qualified reviewers.

5. Limitation of liability

To the maximum extent permitted by law, ErrorLens and its contributors are not liable for any damages arising from your use of the tool, including losses caused by findings, missed findings, or actions taken in response to a report.

6. Contact

Questions about these terms can be sent to kohape0@gmail.com or opened on GitHub.

Legal

Privacy Policy

Effective 2026-08-10 · Last updated 2026-08-10

What we collect

Nothing. ErrorLens is a static site with no backend. We do not collect, store, or process any personal data, and we do not use cookies, trackers, or analytics scripts.

Where your data lives

Everything you enter — scan scope, findings, custom checklists, and settings — is written to your browser's localStorage. It never leaves your machine. Clearing your browser's site data removes it.

Network requests you control

Running smoke checks issues requests only to (a) the target site URL you provide, (b) the RPC endpoint you provide, or (c) a CORS proxy you configure to read security headers. We do not proxy your traffic through our own servers.

AI-assisted drafting (optional)

If you enable it, the API key and endpoint you enter are stored only in your browser. When you click "Draft with AI", the current finding's title, severity, surface, and area are sent to that endpoint. We do not see or store these requests.

Exports

Reports and session files you download or upload are yours. We never access them. Session exports deliberately exclude your AI key.

Contact

For privacy questions, contact kohape0@gmail.com or open an issue on GitHub.

Untitled scan

Surfaces

One lens over every attack surface in your project.

Eight surfaces, one workflow

From target to report in four steps

Set your target

Run the checklist

Log what you find

Ship the report

The severity model behind every finding

Set your audit target

Run the checklist

Smoke checks

Guided checks

Your own checks

Review and ship the report

Findings by severity

Positive observations & test gaps

Findings

Markdown output

Terms & Conditions

1. What ErrorLens is

2. Authorized use only

3. Local data & privacy

4. No warranty

5. Limitation of liability

6. Contact

Privacy Policy

What we collect

Where your data lives

Network requests you control

AI-assisted drafting (optional)

Exports

Contact

Log a finding

Start a quick scan

Add a scan surface