Real tools, built to solve real problems

When something breaks, the answer is usually buried in a log — the file a system writes to record every event it produces, which on a busy service grows to gigabytes. General-purpose editors freeze trying to open something that big, and plain find-in-file can only match a word, not answer the question that actually matters: which requests failed, grouped by page, slowest first?

A deliberately UI-free engine does the hard parts — a hand-written query language (its own lexer, parser and evaluator, plus a filter-and-aggregate pipeline) and a memory-mapped index that opens enormous files without ever loading them into memory. The desktop app and a native command-line tool are two thin front ends over that same engine, which was built and proven green before a single pixel of interface existed.

Accessibility-lawsuit demand letters target real WCAG failures, but the overlay widgets sold as a fix don't fix them (and have themselves drawn FTC action), while a manual audit is slow and costly. Owners need to know their actual exposure — and be able to prove, later, what the site looked like on a given date.

Built deliberately without the overlay approach it is meant to replace: it inspects the real DOM across many interaction states client-side, maps each finding to the exact WCAG criterion and a fix, and seals the result as tamper-evident, independently verifiable evidence.

Wiretapping and privacy class actions — CIPA, GDPR, the wave of live-chat and session-replay suits — all turn on one factual question: did data leave the visitor's browser before they agreed? Most businesses can't answer it, and can't prove their answer.

Instruments the page's network and script activity in the browser, classifies each request against a catalog of known trackers, and pins the finding to a signed, timestamped record that stands up as evidence rather than a screenshot.

The riskiest words on a site are often in the marketing copy — “guaranteed,” fake urgency, an unsubstantiated “made in USA,” buried fees — and the FTC has levied eight- and nine-figure penalties over exactly these. Most owners have no idea which of their phrases are landmines.

A client-side scanner matches page copy against a curated catalog of FTC-enforced claim patterns, each tied to its own case and penalty; the only optional network call is to your own Claude key for rewrites, so the audit itself stays private.

You build on your own machine, it works perfectly, you hand it over — and it fills the client's screen with errors, because their host runs an older PHP than yours. WordPress's own Site Health only inspects a single environment; PHP compatibility checkers only lint code in isolation. Neither answers the question that actually matters before you deploy.

Two tools that normally live apart — Site Health inspects one environment, PHP-compat linters check code in isolation — fused into one go/no-go answer. The scanner is a from-scratch, dependency-free tokenizer so it runs on any host, and it escalates automatically to PHP_CodeSniffer with the PHPCompatibility standard when a host can support it.

You're sitting on years of genuinely good posts buried on page 14 of the archive, invisible to new readers and long abandoned by search crawlers. The common 'fix' is to fake publish dates so old posts look new — which does nothing for Google and can backfire. The honest play is to resurface what's still worth reading and be straight about when it changed.

Built honesty-first: it refuses the date-faking dark pattern by default, disables re-floating automatically on date-based permalinks so it can never break your URLs, and keeps the AI strictly advisory behind your own key. Every automated pass is logged, so you can go back and do a real content pass on the ones worth it.

Every backup plugin makes a backup. Almost none of them ever check that the backup actually restores — you find that out on the worst possible day, when the zip is corrupt or the database dump won't import. 'I have a backup' and 'I have a backup I've proven restores' are completely different things.

The whole design is about making the undo real: it test-restores databases and integrity-checks archives rather than trusting them, is honest about which strength of 'verified' applies to each point, and ships a ZipArchive / PclZip archive layer so it runs even on hosts without the PHP zip extension.

Plenty of shops charge custom-build prices for a lightly-reskinned template, and most business owners have no way to tell the difference. There was no quick, honest way to ask 'is this site actually custom, and is it any good under the hood?' without hiring someone to audit it.

A small PHP endpoint on the same host as the site — no separate server to babysit. It fetches and fingerprints the page, captures a screenshot with headless Chrome, and hands both to Claude for an honest visual and structural assessment. It degrades gracefully: with no screenshot capability it simply runs screenshot-free rather than faking visual scores.

Most small businesses have broken or missing email authentication, and it quietly costs them twice: anyone can send email that looks like it comes from their domain (fake invoices, phishing aimed at their customers), and their own legitimate mail is more likely to land in spam. The existing checkers are either enterprise-technical or make you hand over your email data just to see the results.

Deliberately backend-free: every lookup runs in the visitor's browser via public DNS-over-HTTPS (Google and Cloudflare, with fallback), so there is no server to run and nothing to log — which is also the honest privacy story. The grading and report-parsing logic is split into dependency-free modules that are unit-tested in Node against real domains and real reports.

Rental marketplaces exist, but nobody serves the cross-asset swap — “I'll lend you my Class A diesel pusher while I take your riverboat cabin.” And the hard part isn't the listings; it's the matching, when each side has strict, opposite requirements (must be a diesel pusher, off-grid; must be over 40, no pets) on overlapping dates.

Built to compile to a single self-contained executable: a pure-Go SQLite driver (no C compiler) plus go:embed for every asset, and Go 1.22 pattern routing instead of a framework. The matching logic is isolated and was proven on seed data before any UI existed.

A plain calendar reminder doesn't know that a food truck in Texas and a salon in Ohio have completely different obligations, and enterprise compliance software is priced for whales. Small operators miss renewals and get fined, lapsed, or shut down — with nothing built for their end of the market.

FastAPI serving both a server-rendered Jinja2 UI and a typed API from one codebase; the pure recurrence/exposure engine has no I/O and was verified on seed data first. Standard-library sqlite3 and PBKDF2 mean the only dependencies are the web stack itself.

Town halls and all-hands need a way to surface the questions the room actually cares about and read it live. The hard part isn't the form — it's keeping every attendee's phone and the presenter's screen in sync in real time.

Express for HTTP and Socket.IO for the real-time layer, with room-based broadcast so each event is its own channel. The engine that matters — multi-client broadcast and de-duplicated voting — was verified headlessly first, then the audience and presenter clients were built on top.