Architecture check

Which endpoints reach your data without authenticating?

Paste a public GitHub repository. Wyro reads its routes and data models and shows every path from an endpoint to a table that skips a guard.

Public repositories. No install, nothing stored. Findings open with a free account.

Try onehagopj13/node-express-boilerplateExpress + Mongoose fastapi/full-stack-fastapi-templateFastAPI + SQLModel

Backends checked

111

Popular public repositories

Routes read

4,427

1,084 tables behind them

Findings

2,800

221 errors2,579 warnings

With an error

28/111

Backends with at least one

Already checked

Cleanest architectures: no errors, fewest findings, at least 5 routes. Bigger clean systems rank higher.

1genalhuang/genal-chatNestJS176No findings 2haixiangyan/nest-todoNestJS172No findings 3SAP-samples/cap-hana-exercises-codejamSAP CAP122No findings 4SAP-samples/btp-cap-genai-semantic-searchSAP CAP101No findings 5andrechristikan/ack-nestjs-boilerplateNestJS197261 finding 6lujakob/nestjs-realworld-example-appNestJS2151 finding 7SAP-samples/btp-cap-genai-ragSAP CAP1121 finding 8rafsaf/minimal-fastapi-postgres-templateFastAPI821 finding 9gaganpreet/fastapi-starterFastAPI721 finding 10zclzone/isme-nest-serveNestJS3842 findings 11wenqiyun/nest-adminNestJS36112 findings 12andregardi/jwt-express-typeormExpress712 findings 13rawheel/fastapi-boilerplateFastAPI512 findings 14SAP-samples/ui5-cap-event-appSAP CAP522 findings 15taozhi1010/nest-adminNestJS129233 findings 16CatsMiaow/nestjs-project-structureNestJS2223 findings 17pvarentsov/typescript-clean-architectureNestJS1533 findings 18reliverse/relivatorNext.js583 findings 19ghostfolio/ghostfolioNestJS118194 findings 20anthonycorletti/cloudrun-fastapiFastAPI1424 findings 21kanbn/kanNext.js1625 findings 22vanxh/openbioNext.js1285 findings 23fastapi/sqlmodelFastAPI1075 findings 24Buuntu/fastapi-reactFastAPI1015 findings 25ghostlexly/ultimate-expressjs-starter-kitExpress665 findings

What comes back

Not a score and not a summary. Every finding is an endpoint, the table it reaches, the path between them, and the rule it breaks — so you can open the file and check the claim yourself.

The engine is rule-based, so the same commit always produces the same verdict. If a repository is in a language or framework it cannot read, it says that instead of reporting a pass.

TypeScript: Express, Fastify, Hono, NestJS, Next.js App Router
Python: FastAPI
Schemas: Prisma, Drizzle, TypeORM, Mongoose

Run it where the code is

Browser extension

This check on every GitHub repository you open, including private ones, which never leave your machine.

Chrome Web Store Download the build

Command line

npx wyro-check .

Same engine, same verdicts, reading your working tree. Exits non-zero on an error so CI can fail on it.