DEV Community: Compound Labs

Four SaaS tools that leave a queue, a binder, a wire, or a drafted reply

Compound Labs — Mon, 28 Sep 2026 22:46:32 +0000

Compound Labs has four SaaS tools for different working days. They leave behind concrete things: review replies, support queues, accessibility binders, and a daily email.

What this issue carries

These tools turn incoming work into something a person can inspect and act on.

StarReply


	StarReply is a review-reply agent for multi-location businesses. It reads reviews, drafts replies in your voice, and holds them for approval. A business owner gets a review queue with the source review, its classification, confidence, and the proposed reply. The individual plan costs $5 per month.

TriageDesk


	TriageDesk reads a shared support inbox overnight, classifies each message, and drafts one reply per thread. It is for teams handling support through Microsoft 365 or Gmail. The morning result is a queue of cards that a human can approve, edit, or reject. It costs $5 per month per inbox, and nothing sends without approval.

The Standup


	The Standup is a daily wire for software releases, CVEs, outages, and breaking changes. It is for developers who need a short record of changes that may require action. The board carries the consequence on each line, and the 07:40 email preserves the same ordering. The archive and the daily email are available through the publication.

CivicBinder


	CivicBinder scans a public entity website against WCAG 2.1 AA and produces a Title II readiness binder. It is for cities, counties, districts, and other public entities preparing an accessibility record. The binder contains ranked findings, a document inventory, an accessibility policy, an accessibility statement, and a dated remediation plan. The complete record costs $19 for entities under 50,000 in population.

CivicBinder scans a public entity website against WCAG 2.1 AA and produces a Title II readiness binder. It is for cities, counties, districts, and other public entities preparing an accessibility record. The binder contains ranked findings, a document inventory, an accessibility policy, an accessibility statement, and a dated remediation plan. The complete record costs $19 for entities under 50,000 in population.

One issue a week, and one shipped product taken apart every month. What each product does, what it cost to build, what the pipeline behind it looks like, and what the numbers did, read off the repository and the live site, not written from memory. Join the list.

Four consumer tools for checking, matching, reading, and calling

Compound Labs — Sun, 27 Sep 2026 22:34:19 +0000

Four consumer tools for checking, matching, reading, and calling.

What this issue carries

This issue carries four consumer tools with a clear result on the page. Each one turns a small decision into something you can inspect.

ScriptProbe


	ScriptProbe checks what an npm package runs when it installs. Paste a package name to see its install scripts, whether they reach the network, and whether its maintainers or publishing account changed recently. It is for developers checking a dependency before it enters a project. The result is an instant report about the package's install behavior and recent ownership signals.

MatchLine


	MatchLine checks a resume against a job posting. It reads each requirement, shows which resume line proves it, and names the requirements with no evidence. It is for job seekers who want the gap between a posting and their resume in plain view. The check is free, and the tailored ATS-formatted resume comes as a PDF.

This Much We Know


	This Much We Know writes down documentary episodes in full context. Each record carries the question the film asks, every spoken line in order, the pictures it shows, who holds them, and the film itself above the transcript. It is for viewers who want to inspect what a documentary actually says and shows. The result is a transcript paired with the episode's visual and ownership record.

WireCall


	WireCall is a daily call on the news wire. Pick the story from today's slate that you think will still lead its wire tomorrow, then call whether it rises or falls. It is for anyone who wants a small daily prediction with a visible record. You get the day's slate, a call history, settled results, and a leaderboard, with no account needed to play.

Four compliance filings from Compound Labs

Compound Labs — Sat, 26 Sep 2026 22:19:29 +0000

Four compliance filings from Compound Labs, each leaving behind a concrete document, report, workpaper, or log. The pages show what each product checks, who uses it, and what the result contains.

This issue

These products turn source material into compliance records that people can inspect and use.

PolicyDrift


	PolicyDrift checks what a site actually loads against what its privacy policy claims. It is for people responsible for understanding third-party contacts on a website. Each report lists the observed contacts, the policy statements, and the findings that connect them.

TrustDesk


	TrustDesk gives small platforms a report form, a 48-hour clock, and an append-only log for removal requests under the TAKE IT DOWN Act. Platform operators receive a tracking code, status record, and evidence export. The desk also generates an NCII notice from the platform name, site URL, and monitored removal address.

Truing


	Truing reconstructs 2026 W-2 box 12 codes TT and TP from a payroll register export. It is for payroll teams checking whether overtime records contain the split needed for year-end reporting. The result is a workpaper with hours, overtime, rates, service charges, required premiums, shortfalls, statuses, and import lines.

PartsProof


	PartsProof prepares Cyber Resilience Act reporting materials for small hardware and software makers. The pack includes a vulnerability disclosure policy, an SBOM, and a 24-hour reporting runbook. The expanded pack adds product-specific reporting templates and a dependency review against the SBOM.

Four platform tools from Compound Labs

Compound Labs — Fri, 25 Sep 2026 22:02:07 +0000

This issue carries platform tools from Compound Labs.

Platform tools

Each section names one platform tool and its purpose.

Context Window


	Context Window is a platform tool from Compound Labs.

ParseRail


	ParseRail is a platform tool from Compound Labs.

StackTab


	StackTab is a platform tool from Compound Labs.

Tearline


	Tearline is a platform tool from Compound Labs.

BreachProbe finds database leaks in shipped apps

Compound Labs — Thu, 24 Sep 2026 15:34:47 +0000

breachprobe.thecompound.tech

Security checks can return a clean result even when the check itself cannot reach what it tests. Commit 2a513f7 fixed that in BreachProbe by proving Supabase JWT signing secrets with HMAC verification and adding seven cases to the deploy check.

BreachProbe

The scan console

The console accepts one app URL and labels the scan read-only. It shows that no account or installation is required, then lists the checks in order.

The scan reads shipped JavaScript, probes Supabase REST endpoints, checks response headers, looks for broken-auth patterns, inspects Stripe routes, and creates two signed-in test accounts for cross-tenant checks.

The sample report

The sample report shows a scored app with a grade, severity totals, issue titles, evidence locations, and written fixes. Its critical finding reports cross-tenant reads across three tables from two signed-in users.

The report turns that finding into a policy change using auth.uid() and the affected owner column, then tells the reader to rerun the scan.

Every check

The checks page lists real check IDs, titles, severities, and whether each check carries a written fix. The console currently exposes 33 issue types and 32 written fixes.

The list separates shipped-code checks, response-header checks, Supabase REST checks, signed-in-user checks, and Stripe-route checks so the source of each verdict stays visible.

The method page

The method page explains what each probe sends and what answer counts as proof. It states that JWT candidates are checked against the app's own public anon key instead of being reported from string shape alone.

The signing-secret verifier recomputes the HS256 signature:

+function signs(jwt: string, secret: string): boolean {
+  const i = jwt.lastIndexOf('.');
+  if (i < 0) return false;
+  const signingInput = jwt.slice(0, i);
+  const given = jwt.slice(i + 1);
+  const want = crypto.createHmac('sha256', secret)
+    .update(signingInput).digest('base64')
+    .replace(/\+/g, '-').replace(/\//g, '_')
+    .replace(/=+$/, '');
+  return want === given;
+}

The failed-scan state

The scan bar keeps its four operating terms visible when a scan fails: no account, nothing installed, read-only, and one URL. The error appears on its own row beneath them.

Commit 291abad changed this state after the error message displaced those terms. The same commit moved the demo destination to the sample report so the console's worked example opens from the scanner surface.

BlockDex searches shadcn registries item by item

Compound Labs — Wed, 23 Sep 2026 15:26:48 +0000

blockdex.thecompound.tech

When a component install fails, the library name does not tell you why. BlockDex puts the item, install command, dependencies, access result, preview state, and last-seen date in the same console.

BlockDex

Console

The Console opens with item-level search across public shadcn registries. It shows filters for kind, access, preview state, and order, plus saved queries such as "marquee," "bento grid," and "file upload."

Search narrows the index to components, blocks, hooks, themes, utilities, or examples. The access controls separate free, paid, and unverified results, while the order control switches between relevance, recent indexing, registry stars, and name.

Search results

A result row shows the item name, registry, access verdict, install command, dependencies, preview state, and whether the registry endpoint answered. The "marquee" results include free, paid, and unverified entries in one view.

The result view lets you compare items that share a name without treating them as the same component. Each row keeps its registry identity and install source visible before you open the record.

Item record

An item record shows the identifier, type, file count, first-seen date, last-seen date, registry, stars, install test date, and preview status. The "spell-ui:marquee" record also shows the exact install command and its motion dependency.

The record gives a developer the details needed before copying an install command. It also links to the registry endpoint and the registry's own page when those references are present.

Registries

The Registries page shows 982 registries with a parsing manifest, holding 76,017 items. Its table includes item totals, free results, stars, licence, last push, and access classification.

The page sorts registries by item count, GitHub stars, recent push, or name. Its access filter separates registries where every item endpoint answered without a key, registries with mixed results, registries returning 401, and registries with no item endpoint to ask.

Free blocks

The Free blocks view isolates items whose endpoint returned source without a key. Each result still carries its install command, registry name, dependencies, and preview state.

The view makes the free verdict depend on the item endpoint returning source. An unverified item stays out of the free set when no endpoint answers, even if its registry page describes the component as free.

Method

The Method page shows how BlockDex finds registries, reads manifests, checks item endpoints, classifies access, and records removal. It also states that the index does not judge quality, accessibility, design, or licence meaning.

The method keeps the claim narrow. BlockDex can show what an endpoint returned, whether an item still appears in a manifest, and whether an install test passed. It does not turn those checks into a quality score.

Install matrix

The install matrix shows the shadcn CLI version, the last run date, install attempts, failures, untested rows, and rendered previews. It also shows the command printed on each row and the result returned by the scratch application.

The matrix tests a slice of free rows in a scratch shadcn app. A row without an install result remains untested, and a component appears as rendered only when the registry licence permits the source to be used there.

Four AI agents across different workflows

Compound Labs — Tue, 22 Sep 2026 15:20:04 +0000

Four AI agents turn routine work into a queue of decisions, documents, and exceptions. This issue covers products for subscription billing, contract renewals, invoice chasing, and month-end reconciliation.

Working queues

Each product turns a recurring operational task into a reviewable result.

CardChase


	CardChase recovers failed subscription charges before they become churn, with retries and customer notes waiting for approval. It is for subscription businesses that need a retry queue, editable messages, and receipts for every action. It costs $9 a month.

ClauseWatch


	ClauseWatch reads uploaded contracts, finds renewal dates and notice periods, and warns before an auto-renewal locks in. It is for people managing vendor agreements who need quoted paragraphs, page numbers, and a queue of dates that need attention. Standard costs $9 a month, and Team costs $29 a month.

FetchDue


	FetchDue reads an agency's overdue invoices and mailbox, drafts replies in the agency's voice, and follows up until payment lands. It is for agencies and bookkeepers who need prepared chases, classified replies, payment plans, and an approval queue. Pro costs $9 a month, and Firm costs $29 a month.

MatchRail


	MatchRail reconciles purchase orders, receipts, and bills against QuickBooks or Xero, then queues only the disagreements. It is for bookkeepers closing the month who need side-by-side exception evidence and an audit trail. Pro costs $9 a month.

Four rankings for people choosing what to trust

Compound Labs — Mon, 21 Sep 2026 15:05:41 +0000

This issue carries four rankings that turn messy decisions into named queues, reports, and comparisons.

What this issue carries

Each page gives a different kind of ranking. The useful part is the concrete thing left behind for someone making a decision.

ShipWall


	ShipWall ranks product launches for builders who want to see what shipped today. The board shows ten launches a day, freezes at midnight UTC, and keeps listings from expiring. You get the daily board, frozen days, and the queue.

BreachProbe


	BreachProbe checks whether a shipped app exposes its database. It is for people testing apps built with Lovable, Bolt, v0, or Supabase. You get a severity-ranked report with the affected checks and a written fix for each issue. The full report costs $19, and monitoring costs $39 for 30 days.

LeadGrade


	LeadGrade scores inbound leads for founder-led sales teams and ranks the queue highest-first. It reads the lead, applies the scoring rules, and holds writes to HubSpot for 60 seconds so you can approve or kill them. You get the ranked queue, the score breakdown, and the held write.

Toolproof


	Toolproof is a register of independent measurements for AI agent tooling. It is for developers comparing agent frameworks, coding tools, and configuration files. You get dated rankings, the method behind each index, the source data, and a reusable read API.

Four filings that leave a document behind

Compound Labs — Sun, 20 Sep 2026 14:48:51 +0000

An unemployment response, an accessibility binder, and a HOTMA decision sheet are the documents in this roundup. Each page turns a deadline or rule into paperwork someone can review, adopt, or send.

On paper

These pages produce documents for employers, healthcare practices, and public housing agencies.

Unemploy


	Unemploy prepares unemployment claim responses and benefit-charge protests for employers. You get a finished draft with the evidence behind each sentence, and you approve every filing before it goes out.

CivicBinder Health


	CivicBinder Health gives clinics, dental offices, and community health centers a Section 1557 Readiness Binder for website accessibility. The binder contains a WCAG 2.1 AA evaluation, document inventory, accessibility policy, public statement, and dated remediation plan.

QuorumFile


	QuorumFile gives public housing agencies a free Decision Sheet for HOTMA policy adoption. Answer the agency questions and it produces the redlined ACOP or HCV Administrative Plan chapter, plus the paperwork that proves the board adopted it properly.

BenchFile checks a building for open NYC benchmarking violations

Compound Labs — Sat, 19 Sep 2026 22:27:30 +0000

BenchFile checks a New York City building for an open Local Law 84 benchmarking violation, then shows the notice, penalty and next posting date in one console.

BenchFile

Building lookup

The main page opens with one Building field, an address or a 10 digit BBL, and a Check button. The console shows the matched address, owner, BBL, floor area, units and public record link.

BenchFile sends the lookup to the city's live tables and returns the building's current benchmarking notices. It keeps the address out of its own records.

How this answer was read

The building panel shows four named stages: resolving the address to a tax lot, searching open benchmarking violations, pulling the building record, and counting the accrued penalty and next posting date.

BenchFile shows the datasets behind the answer and the time for each completed stage. The page names the public datasets instead of presenting the result as an unexplained score.

Open notices

The center column shows the building's open notice count, accrued penalty and date for the next $500 posting. A notice clock places the open violations against the quarterly deadlines.

BenchFile lets you select an individual notice and load its violation number, issue date and payment kit. The newest notices appear first in the ledger.

Building record

The building record view shows the address, borough, BBL, owner, building class, year built, floor area and unit count. It also lists nearby buildings with their open notice counts.

BenchFile uses the record to explain why the lookup returned its answer. The page separates the city's public building facts from the notices attached to that building.

Pricing

The pricing page shows two plans, Clear the violation and Stay compliant. The first is $149 once and then $49 per year. The second is $49 per year.

BenchFile uses the open notice state to select the relevant plan. A building with an open violation receives the cure path, while a covered building without an outstanding notice receives the annual filing path.

Questions

The Questions page presents an accordion covering the coverage threshold, quarterly penalties, filing authority, payment responsibility, challenge windows and the difference between benchmarking and energy-grade duties.

BenchFile uses the answers to separate actions the filing service handles from actions the owner must take. The page states that the owner still pays the accrued penalty and approves the utility data release.

Status

The Status page shows whether BenchFile is operational and when the service last published its state. It does not fill an unavailable feed with a green result.

BenchFile keeps service health separate from the building lookup. A working status page does not stand in for a current notice search.

Security

The Security page states that BenchFile has no visitor accounts. It explains that an address is sent to the city's public data service for the lookup and is not written down by BenchFile.

The page also identifies the data processors used for hosting, analytics, payment and the city lookup. It states that card details are entered on the payment provider's hosted page.

Four archives that keep short films and observations on the page

Compound Labs — Fri, 18 Sep 2026 22:10:07 +0000

This issue carries four archives that turn short films and observations into pages you can read.

What this issue carries

These are small publications with their own subjects and formats. Each gives the words, images, or objects a place to stay after the original moment passes.

Why Your Brain Does That


	Why Your Brain Does That is an index of named experiences and the reasons behind them. It is for anyone trying to understand a familiar mental habit, and it gives you a readable page for every spoken explanation.

whyyourbrain.thecompound.tech

Soft Money Journal


	Soft Money Journal records ten minutes, a notebook, and the order things get paid in. It is for people thinking through money in plain language, and it gives each short film a written page.

soft-money-journal.thecompound.tech

Still Mornings


	Still Mornings is a record of slow mornings for anyone who wants ten minutes before anyone needs them. Each page carries the hook, the four spoken lines, and a frame from the morning it came out of, alongside the archive, weekly letter, and feed.

still-mornings.thecompound.tech

Using It Up


	Using It Up is a publication about finishing what you already own, including things used to the last of them, mended, kept, and not bought. It is for anyone paying attention to what they already have, and it gives each object a page, a still, spoken lines, and a place in the archive.

usingitup.thecompound.tech

Multiple shipped products, taken apart, few times a week. What each one does, what it cost to build, what the pipeline behind it looks like, and what the numbers did, read off the repository and the live site, not written from memory. Join the list.

Four filings that end with a document to sign or file

Compound Labs — Thu, 17 Sep 2026 21:55:24 +0000

A CPSC certificate, an NYC benchmarking report, and nonprofit reinstatement filings all end as documents somebody has to sign or file. This issue carries four filings from products that turn a live record into paperwork you can act on.

What this issue carries

Three short product notes for people handling product certificates, building reports, or nonprofit reinstatement.

CertScope


	CertScope settles which CPSC rules apply to each imported SKU, then builds the certificate a broker needs to clear it. Product importers get a rule determination and a certificate to review and file.

certscope.thecompound.tech

BenchFile


	BenchFile finds a New York City building's open Local Law 84 benchmarking violation, files the overdue report, and keeps the building filed each year. Building owners and managing agents get the report, the cleared violation, and the city's dated proof. You pay $149 once, then $49 each year for the continuing filings.

benchfile.thecompound.tech

GoodStanding


	GoodStanding checks an organization's IRS auto-revocation status, works out the 15-month clock, and prepares the filings needed for reinstatement. Nonprofit officers get the government record, a dated checklist, and either a Streamlined Cure Pack for $79 once or a Full Reinstatement Pack for $199 once.

goodstanding.thecompound.tech