A ridiculous verdict.
A boringly specific method.
Quick scan, not the full engine
This page is the CrossCheck Quick Scan: a fast check of root package-manager signals in a public repository, built to run in seconds with no account. It is deliberately narrow and it is not the CrossCheck engine. Full CrossCheck reads nested packages and workspaces, CI and Docker install steps, manager-specific configuration such as pnpm-workspace.yaml and bunfig.toml, and evaluates each pull request as the repository changes. It is MIT-licensed and runs in your own GitHub environment: github.com/zFinia/crosscheck.
What is actually inspected
Only public GitHub data. We resolve the public default HEAD through Git’s advertised refs, then request root package.json at that immutable commit and check six fixed paths: package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock and bun.lockb. No repository code runs. No GitHub credential or visitor account is used. Lockfile contents are not downloaded.
How the personality is assigned
- Lockfile Poltergeist: the quick scan finds more than one recognized manager across the root declaration and lockfile paths. We explicitly downgrade its conflicting-config label to an advisory: coexistence and intent are unknown, not proven defects.
- Suspiciously Functional Adult: at least one recognized manager signal exists and the inspected signals do not disagree. This is clean only within this subset.
- Repository Cryptid: a readable root manifest supplies no recognized manager signal and none of the known root lockfile paths is present. Inconclusive; never represented as clean.
npm’s package-lock.json and npm-shrinkwrap.json count as the same manager. The archetypes are deterministic entertainment, not scores for security, quality, reliability, vulnerabilities or financial outcomes. There is no numerical curse score.
What is not inspected
Nested packages, workspaces, CI workflows, deployment roots, install commands, dependencies, lockfile consistency, symlink modes, declared exception contracts and runtime behavior. A raw public path may be a symlink; presence does not prove usable regular-file contents. Multiple managers can be intentional. Do not delete files based on the joke.
Unknown stays unknown
Missing or unreadable manifests, private repositories, redirects, timeouts, oversized data, throttling and failed reads return an explicit unavailable or unsupported message, never a clean verdict. The root manifest is limited to 128 KiB, HEAD discovery to 64 KiB and each GitHub request to eight seconds. Each new snapshot uses at most two public GETs and six HEAD requests, with at most three simultaneous file checks. No GitHub REST API quota or privileged token is consumed.
Sharing and privacy
The URL contains a signed snapshot: public repository name, commit, observation time, recognized manager and file-presence flags. It contains no source text, IP address, account credential or private repository data. Anyone with the URL can view those public facts. The signature prevents editing the verdict. Links remain valid while the signing key is retained; key rotation can invalidate old links. Shared result pages and cards never trigger another repository scan.
Source text lives only in request memory. A bounded server cache retains public facts for up to ten minutes. Per-instance request limits and concurrency limits reduce abuse; they are not a distributed hard quota. Short-lived rate-limit buckets use a keyed digest of the incoming network address, not a stored raw IP. Existing hosting protections also apply. Custom analytics events contain bounded funnel labels, not source text or repository names.
The paid product
The free check and sharing need no account, GitHub installation or card. CrossCheck Starter is US$29/month recurring for up to three protected repositories. Paid activation uses GitHub authorization and CrossCheck runs in your GitHub environment. It does not promise to prevent every defect. Cancel through the genuine billing process described in the subscription details.