Skeptical buyers will not connect GitHub to a site they do not know. Run the engine on your laptop, offline. Production-path issues stay on the main board. Test, mock, and fixture findings are parked so you are not drowning in another alert pile.
npx simplebeacon scan --gate --offline
PAYMENTS_URL = os.getenv(
"PAYMENTS_URL",
"https://mock-payments-stage.example"
)
Tests pass. The application works.
But production can silently use a test payment system.
CRITICAL — Production fallback points to staging payment infrastructure.
Tests tell you whether code works. SimpleBeacon checks whether it works against the reality you intended.
Your AI coding agent can make your tests pass—and still wire production to the wrong reality. Existing tools tell you whether the code works. SimpleBeacon checks the assumptions underneath it.
const METRICS_DATA_PATH =
'./fixtures/sample-metrics.json';
const conversionRate = '75%';
Most developers: “It’s demo code.”
This code is in a production handler.
CRITICAL — Production sample-data dependency
CRITICAL — Hard-coded KPI
That’s what SimpleBeacon is for.
The dangerous generated code isn’t ugly. It’s believable code that isn’t true.
Staging or mock infrastructure wired into production fallbacks and defaults.
Fixtures or fabricated metrics presented as live data in production handlers.
Placeholders and no-op implementations that look finished and ship anyway.
APIs and packages that don’t actually exist, with completely reasonable names.
Local and offline first. Source stays in your environment. Accounts are for team automation, not for trying the product.
If you need evidence of how you control AI-generated software, SimpleBeacon produces an audit trail of what it found, what was fixed, and when it was fixed. That’s a verification report—not a compliance certificate.
npx simplebeacon scan --gate --offline
No upload. Add the GitHub Action only after the local scan earns trust.