About
Don't just run it.
Vibe coding is pasting what the model said. That is fine until the model — or the gist it quoted — hands you a pipe into bash. Don't Just Run is the pause. Not a scanner in the cloud. Not another chatbot. A briefing.
How it works
The engine is a pile of deterministic rules plus a package-name parser. It runs in the request that renders /analyze. There is no LLM in v1, no account, and no database. Optional registry lookups ask npm, PyPI, crates.io, or proxy.golang.org whether a name exists — they receive the package name, not your script.
Risk lands in four stamps: SAFE, CAUTION, DANGEROUS, CRITICAL. Findings cite the snippet they matched. Touches list files, hosts, and packages. Alternatives are boring on purpose.
What we look for
- Destructive
- rm -rf on broad paths, disk wipes, fork bombs.
- Remote code
- curl | bash, wget | sh, PowerShell irm | iex, decode-then-exec.
- Privilege
- sudo / doas, chmod 777, su root.
- Secrets
- SSH keys, .env, AWS credentials, tokens in the paste.
- Persistence
- bashrc, cron, systemd, launchd, schtasks.
- Supply chain
- HTTP installs, paste hosts, git URLs, typosquats, missing packages.
- Exfil
- curl uploads, netcat, webhooks, scp of local files.
- Obfuscation
- base64, hex, eval, ${IFS}, invisible Unicode.
Privacy
We do not store pastes. A ?q= or ?c= share link puts the command in the URL (and therefore in the request). A #c= hash stays in the browser and needs JavaScript. Prefer the hash if the command is sensitive; prefer the query if you need the briefing without hydration.
What v1 is not
- Not a sandbox. We do not run your command.
- Not malware analysis. Unknown binaries stay unknown.
- Not a substitute for reading the script.
- No auth, no team workspace, no history.
Contact
Domain brand: dontjust.run
Support: support@dontjust.run