Local-first project intelligence
Know where every project stands, and what to fix first.
Forge audits repositories on your computer, backs every finding with code evidence, and turns the work into plans for Claude Code, Codex, or Cursor.
- Never changes code
- Runs locally
- Secrets removed
OverviewCredits1,840
Good morning · Tuesday 6 OctoberYour projects~/coding · 5 projects · each project scanned when you press its Rescan
Ask ForgeBrief meProjects5
Active3
Avg. features58%
Prod-ready0of 5
Stalled1needs attention
Field NotesActiveOffline-first notes app for researchers working without signal.Next.jsTypeScriptTailwind
In active buildFeatures4 of 6 milestonesProduction readiness4 of 9 checks
Key componentsNext.js appSQLite syncPhoto captureMap viewExport
Next steps
- 1Shared notebooks
- 2PDF export
Last activity todayScanned just nowdevelop
Atlas APIActiveBilling and auth API behind the Atlas customer dashboard.TypeScriptStripe
In active buildFeatures4 of 6 milestonesProduction readiness2 of 8 checks
Key componentsAuth & token refreshBilling & invoicesStripe webhooksPostgres migrationsAdmin API
Next steps
- 1Usage-based billing
- 2Admin audit log
Last activity todayScanned just nowmain1 uncommitted2 Now · 2 Next · 1 Watch
Ledger KitActiveInvoicing and ledger toolkit for a client's accounting team.TypeScript
In active buildFeatures2 of 5 milestonesProduction readiness2 of 8 checks
Key componentsDouble-entry ledgerInvoice PDFsTax rulesPostgres
Next steps
- 1Invoice PDFs
- 2Multi-currency
- 3Client portal
Last activity 3 days agoScanned just nowfeature/invoices
CLI ToolsPausedSmall command-line helpers for releases and changelogs.
PausedFeatures2 of 3 milestonesProduction readiness1 of 5 checks
Key componentsRelease scriptChangelognpm package
Next steps
- 1Homebrew formula
Last activity 8 days agoScanned just nowmain
HarborStalled · 21 daysMarketing site and docs for the Harbor boat-rental app.TypeScript
StalledFeatures2 of 4 milestonesProduction readiness1 of 7 checks
Key componentsAstro siteDocsPricing page
Next steps
- 1Docs search
- 2Blog
Last activity 21 days agoScanned just nowmain
Evidence, not scores
Every finding points back to code.
See the file, line, rule, and reasoning behind each recommendation. Dismiss noise with context, not guesswork.
- Verified file and line references
- Now, Next, and Watch priority lanes
- Focused re-audits of only what changed
Now 2Fix before building anything else
IssuesHighToken refresh can race during retriesReliability · src · SConfirmed in code
What’s thereEvery retry that hits a 401 starts its own refresh. Refresh tokens are single-use, so when two billing requests retry at once, the second rotation fails and signs the service out.Evidencesrc/auth/refresh.ts:9observed
const next = await tokens.rotate(userId, current.refreshToken);rotates without checking for a refresh in flightsrc/http/retry.ts:10observedif (isAuthError(err)) await refreshToken(currentUser());every retry refreshes on its ownSuggested directionShare one in-flight refresh per user: keep the pending promise and let concurrent callers await it.LaneNowNextWatchCreate planIssuesHighStripe webhooks are not signature-checkedSecurity · src · SConfirmed in code
Ask Forge
An engineering manager for every project.
Ask what is risky, what can wait, or how two findings relate. Forge answers from the audit and cites its sources.
Local voiceClaudeOpenAI
ManagerAbout atlas-apiWhat should I fix befo…
What should I fix before I ship the billing update?
Fix the token refresh race first: retries during a billing burst can each rotate the same refresh token and sign the service out. Then verify Stripe webhook signatures, since anyone with the URL can mark an invoice paid. The migration rollback can wait for the next deploy.F1 · Token refresh can race during retriesF2 · Stripe webhooks are not signature-checkedCreate a plan for F1: Token refresh can race during retriesCreate planUses AI; runs in the background
Ask about this project…
Worth a second look
Is your project as healthy as it looks?
The problems that cost the most rarely show up in a demo. Each guide takes a few minutes, with a self-check at the end.
AI-built appsBuilt it with AI? Check what nobody reviewed.The gaps that keep showing up in apps from Lovable, Bolt, v0, Replit and coding agents.Read the guide Security checklistCould one user read another user's data?Access checks, secrets, injection, webhooks and rate limits: the gaps that get apps breached.Read the guide Technical SEOCan Google actually read your pages?Rendering, titles, robots, canonicals and structured data: the SEO you fix in code.Read the guide Codebase structureDoes every fix break something else?Boundaries, layering, cycles and duplication: why structure sets the cost of every change.Read the guide
All guides Local by default
Your code stays on your computer.
Forge sends a model only the context it explicitly asks for. Secrets are removed before that happens, and your code is never stored on Forge servers.
Read the privacy policy- Your computerRepository indexed locallyLocalOnly requested context · secrets removed
- AI modelClaude or OpenAIEphemeralFindings return · no code retained
- Forge serversNo source code storedNo code
Open a project. Know the next move.
Download Forge for Mac or Windows and start with a free scan of one of your projects.
Download Forge