Does REA steal source code?
No. It returns a rebuild in pseudocode and assembly, not your original files, unless you shipped the originals yourself through source maps
Get the XRAY checklistWhat to fix before someone
What to fix before someone
else's agent reads your app
Enter your email and the checklist comes to your inbox. It is the list I used on my own site, in the order I fixed things
The video
The short answer
What REA can read in an app you shipped
REA is a free MCP server that lets an AI agent run a decompiler on any shipped app and label what it finds. It does not break into anything. It reads what the file already contains. On my own website it rebuilt all four files from the public source maps and walked straight past a test key sitting in plain text. The fix is not a product. It is a short list of things the owner has to do before shipping, and most apps have never done them.
Is it legal to run on my own app?
Running it on software you own or have permission to test is the use case here. Running it on someone else's app is governed by that app's terms and your local law. Nothing in the kit covers that
Where do I install it?
Only from the official repository shown in the video. A fake copy of the repository has been handing out malware
Does this replace a security review?
No. It covers the leaks an agent finds in minutes. A real review covers much more
REA in plain English
What it is, and why it lands on you
What REA is
A free MCP server that lets an AI agent run a decompiler on any shipped app and label what it finds
What it does not do
It does not break into anything. It reads what the file already contains
What it found on my site
It rebuilt all four files from the public source maps and walked straight past a test key sitting in plain text
Why it lands on you
The fix is not a product. It is a short list of things the owner has to do before shipping, and most apps have never done them
In the full checklist
What the checklist gives you
A 15 minute test
You run it on your own build before changing anything
The three fixes from the video
With the exact settings for Next.js, Vite, Webpack and Create React App
Web, mobile, desktop and backend
Sections for web bundles, mobile apps, desktop apps built with Electron, and the backend that sits behind a readable client
Protection that is not
The things that look like protection and are not
A ten line release check
You tick it every time you ship
If a key has already shipped
What to do, in order
Free, no call
Still reading? The checklist is one email away
Enter your email and I will send the XRAY checklist to your inbox
Keep readingEvery post
How Minecraft got inside GTA 5
A mod runs Minecraft and GTA 5 at the same time and blends them pixel by pixel. The full breakdown of the mod, with the exact code behind every trick
The launch film prompt: five prompts in Claude Code on Opus 5.5, zero After Effects
The five prompts behind a 34-second launch film made in code with Claude Code on Opus 5.5. Watch the reel, then get the full prompts free
How Spider-Man got inside Batman: Arkham Knight
A mod runs Spider-Man and Batman: Arkham Knight at the same time and pastes one into the other. The full breakdown of the mod, with the exact code behind every trick
Fine print
What this page is, and isn't
- Run REA only on software you own or have permission to test. Running it on someone else's app is governed by that app's terms and your local law.
- Install it only from the official repository linked below. A fake copy of the repository has been handing out malware.
- The checklist covers the leaks an agent finds in minutes. It does not replace a security review.
Building something with AI that has to work
An engineer checks it, fixes it, tests it and puts their name on it
- 30 minutes
- Free
- No slides, no sales team