# Re:Seal

> Re:Seal is a local-first security architect, stack builder, auditor, and automated hardening desktop application made by phyrobyte. Starting from an empty folder or an existing codebase/live URL, it chooses and swaps your entire production stack in clicks, maps your architecture into a trust-boundary node graph, plans five security tiers (Basic through Hypermax), scans for leaked API keys, bypassed paywalls, exposed system prompts, and missing peer route guards (via Differential Spectral Amplification), then writes the code on a dedicated git branch inside a secret-masked local VM and pentests the result.

## Key Facts

- **Category:** Local-first security architect, starter-stack builder, static/live auditor (SAST), and automated hardening app
- **Stack & Architecture:** Recommends concrete, swappable stack picks across hosting, database, auth, server-verified payments, secrets, abuse limits, monitoring, client protection/obfuscation, signing & distribution, and backups—tailored across 5 security tiers (`Basic`, `Normal`, `Advanced`, `Ultra`, `Hypermax`) and visualized as a node graph across `client`, `server`, `storage`, `os`, and `third-party` zones.
- **Audit Targets:** Blank folders, local project repositories, and live websites (pages, same-site scripts, source maps, exposed endpoints, `/.env*`, `/.git/config`)
- **Vulnerability classes:** Leaked API keys & secrets (14+ providers), client-side paywall/licence bypasses, exposed system prompts, public environment/git files, and missing peer auth/billing/tenant guards (DSA)
- **Privacy & sandboxing:** Deterministic rules run offline locally. AI architecture, review, and implementation mask secrets first and run inside a networkless virtual machine on your computer using your own AI account (Claude Code, Codex, Anthropic API, OpenAI API, or Gemini API). Code is never sent to Re:Seal servers.
- **Version control & pentesting:** Creates a dedicated `reseal/<tier>` branch via `libgit2` with one clean commit per task, built-in diff & two-click revert, Lead agent chat steering, and automated pentest + DSA verification.
- **Platforms:** macOS (Apple silicon) and Linux (Ubuntu 22.04+, Debian 12+ on x86_64 and ARM64); Windows in development. Two devices per account.
- **Pricing:** $14/month, $119/year, or $499 one-time Founder seat (50 seats total); every plan includes all features and two devices.

## Core Pages

- [Home](https://reseal.app/): Product overview, interactive stack & tier picker, recorded app workflows, lifecycle stages, and FAQ.
- [Stack & Architecture](https://reseal.app/stack/): Interactive starter-stack & 5-tier planner, node-graph trust zones, and branch-isolated hardening.
- [Scan](https://reseal.app/scan/): How deterministic local rules, secret masking, and the networkless sealed VM audit workflow operate.
- [DSA](https://reseal.app/dsa/): How Differential Spectral Amplification detects missing security or billing guards across peer routes and flags unwired guards.
- [Pricing](https://reseal.app/pricing/): Monthly ($14), Yearly ($119), and Founder ($499) plans, included features, and FAQ.
- [Privacy and cookies](https://reseal.app/privacy/): Essential cookie details, data handling, and zero-tracker architecture.

## Extended Reference

- [Full LLM Documentation](https://reseal.app/llms-full.txt): Complete technical reference covering starter-stack selection, security tiers, model graph, audit rules, DSA math, sandbox guarantees, and FAQ.
- [Sitemap](https://reseal.app/sitemap.xml): XML sitemap of public pages.