{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=dezloper/react-app-audit@0.1.3","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/dezloper/react-app-audit@0.1.3","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/dezloper/react-app-audit@0.1.3","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/dezloper/react-app-audit@0.1.3 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Audits a React or Next.js app in two passes: it reads your source for security problems, then it opens the build you actually ship and measures it. 24 kinds of finding across 6 parallel checks. SECURITY: 12 credential shapes (AWS, GitHub, Stripe, OpenAI, Anthropic, Google, Slack, SendGrid, JWT, private keys) matched against NEXT_PUBLIC_, VITE_ and REACT_APP_ variables and against hardcoded strings, plus 5 unsafe source patterns (dangerouslySetInnerHTML graded by where its data comes from, eval, new Function, innerHTML, document.write) and links opened with target _blank and no noopener. BUNDLE: gzipped JavaScript and CSS totals, the 10 largest chunks, first-load size per route against a budget you set, and which of your dependencies are present in the browser chunks, including 20 server SDKs such as Notion, Prisma, Stripe and AWS that should never be there. ALSO: pages and layouts marked use client, 11 heavy packages and 18 server-only packages imported client side, plain img tags, oversized images, and 7 bui","distribution":{"digest":"sha256:312ef04f15b39a97a7254f495ef5f9738b54ea90146acd5f7232a511fa16a3bb","mediaType":"application/vnd.modiqo.rote-flow","size":23780,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/dezloper/react-app-audit@0.1.3","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/dezloper/react-app-audit@0.1.3","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/dezloper/react-app-audit@0.1.3.json"},"name":"react-app-audit","owner":{"kind":"user","slug":"dezloper"},"parameters":[{"default":".","description":"The React or Next.js app to audit. Defaults to the folder you run it from. In a monorepo, point this at the app folder.","example":"apps/web","input":{"allowCustom":true,"choices":[],"label":"Root"},"name":"root","required":false,"type":"string"},{"default":"500","description":"Report images larger than this many kilobytes.","example":"200","input":{"allowCustom":true,"choices":[],"label":"Max image kb"},"name":"max_image_kb","required":false,"type":"string"},{"default":"130","description":"The first-load JavaScript budget per route, gzipped. Next treats 130 KB as healthy.","example":"130","input":{"allowCustom":true,"choices":[],"label":"First load budget kb"},"name":"first_load_budget_kb","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/dezloper/react-app-audit@0.1.3 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/dezloper/react-app-audit@0.1.3","headlessCommandTemplate":"rote play run https://play.modiqo.ai/dezloper/react-app-audit@0.1.3 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.70.0"},"publishedAt":"2026-09-04T12:41:29.12138+00:00","reference":"dezloper/react-app-audit@0.1.3","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["python3"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":2,"installs":0},"steps":{"count":8,"names":["assess","scan_build_config","scan_bundle","scan_client_secrets","scan_client_weight","scan_images","scan_unsafe_html","validate_project"]},"title":"react-app-audit","type":"play","version":"0.1.3","visibility":"public"}