Reader CLI — Evidence-Only Code Auditor $34.95 · One-time · No subscription

Most tools that claim to “help” with your code will invent problems, rewrite things you didn’t ask for, or quietly change semantics. Reader does none of that.
Reader is a local, evidence-only auditor. It reads your files, reports only what it can prove from the source, and never generates new code from speech or from an LLM. It will not “fix” anything unless you explicitly tell it to, and even then the write path is gated hard: AST identity check, atomic replace, backup first.
What it actually does
Python
Path leaks (Termux, home, .ssh, absolute paths)
Debug leftovers (breakpoint, pdb, DEBUG prints, FIXME/XXX/HACK)
Insecure crypto and weak randomness
Mutable default arguments
Star imports, open() outside with, requests without timeout / verify=False
Base64 blobs, bare asserts, too-many-arguments
String-safe whitespace/zero-width cleanup (only outside literals)
C (tree-sitter)
Malloc / calloc sites with points-to tracking
Alias-aware free matching
One-level returned allocations
Struct field and array storage
Pointer arithmetic (plus/minus only)
Classic surface problems: gets, sprintf, unchecked null, zero-size memcpy, unchecked fopen, empty bodies, while(1), Termux path strings, TODO markers
Every finding comes with file, line, severity, stable ID, and the exact evidence line. No “possible issue.” No “consider reviewing.” Just the evidence.
Voice
SpeechRecognizer (Termux) or typed intent. Voice only logs what you said. It never writes source. “Clean” is always dry-run unless you type --write.
Design rules that do not bend
No LLM
No code generation from speech
No silent mutation
Findings are stable across edits (IDs ignore line numbers)
Every real write is backed up and atomic
Runs entirely on-device
This is the tool for people who are tired of assistants that hallucinate findings or rewrite working code. It is deliberately limited. That is the point.
$34.95 · One-time payment · Instant download
Includes the full Python + C auditor, the points-to pass, the bait file for verification, and the exact install steps for Termux.
If you want an auditor that only reports what it can prove and never pretends to be smarter than your source, this is it.