junhan2/reaproof is a security tool that evaluates with a single command how exposed a deployed app is to AI reverse-engineering agents (agents like rea that reverse an app to extract the code), and blocks the parts that can be blocked. The latest release is v0.9.0, and the provided record does not list the specific changes in this version. It runs as npx reaproof on Node.js 18.3 or newer with no separate installation or setup.
The README states that the tool inspects deployed apps — without access to the source — for information that agents could read as-is, such as original source code or secret values. It explains that the checks fall into four categories. The main targets are common mistakes such as source maps that embed the original mapping, server keys left in the code, and repository folders copied into build artifacts. It ships with a module that reads binary bundle formats across many languages and packaging methods, so after assigning a rea risk grade it restores only what can be removed and shows the before-and-after grades together. Source maps that can be removed are moved to a backup location and can be restored with reaproof undo. Huge source maps are not read whole but scanned in segments to save memory, and the results are also emitted in the standard interchange format for exchanging static analysis results. It is written in JavaScript and licensed under MIT.
That said, it has 4 GitHub stars and the repository was created on October 13, 2026. The research record's scores are freshness 7.0, technical 6.0, completeness 7.0, and momentum 0.5, with only momentum coming out low. The provided record contains no data measuring how much actual blocking effect the rea risk grades deliver. Given the state of 4 stars and momentum 0.5, it is better to check the output results alongside deployment rather than treat this tool as a standalone basis for judgment.