Partly. Runs are metered and cost credits. The prescan, the check table, the edit delta and every bundled example are free and need no account — every lane ships a saved model run, so you can see a whole answer without signing in and without spending a credit.

Does my configuration leave the browser?

Only when you press Run. Dropping a file only reads it in this browser, and the prescan is decided locally with no account, no credits and no network. Pressing Run uploads the configuration to the model.

What happens to a secret that is hardcoded in my paste?

Literal secrets are stripped out before the configuration is uploaded, and you are told what was removed. The prescan still flags that a literal was there — BA-SECRET-LITERAL, BA-OAUTH-LITERAL-SECRET and BA-DB-URL-CREDENTIALS are all critical — so the answer still tells you to rotate it. The value itself is never sent and never stored.

What stops the model from ignoring a problem the prescan already found?

Every prescan flag is sent with the run and the answer must return one reconciliation entry per flag. A flag the model never mentioned is reported on the page as not accounted for: those flags are listed and remain your problem regardless of what the answer says.

Which lanes can I run over the same configuration?

Four, over one paste: Audit the setup, Email and password, Second factor, and Organizations and roles. The hold differs per lane because the prompts and output caps differ, so each lane is estimated separately.

Your Better Auth setup, read properly — then reviewed, hardened, and extended

Paste auth.ts — and your createAuthClient call and route handler if you have them. The browser parses the configuration for free: what you actually set, which plugins are mounted on each side, whether they pair up, and a fourteen-check table. Then pick a lane.

Every lane ships a saved model run, so you can see a whole answer — findings, plan, corrected TypeScript — without signing in and without spending a credit.

Audit the setup

Read the whole configuration the way a security-minded reviewer reads a colleague's auth.ts before it ships.

Drop auth.ts, auth-client.ts or any config file here, or choose files.

Dropping a file only reads it in this browser, and the prescan below is local. Pressing Run the lane uploads the configuration to the model — literal secrets are stripped out first, and you are told what was removed.

Your Better Auth configuration

no configuration loaded

What this app needs (optional)

no notes

Run the lane

Paste a configuration to begin.

Your past runs

Lane

Runs you make while signed in are saved to your account and listed here.

Your Better Auth setup, read properly — then reviewed, hardened, and extended

Audit the setup

Prescan — free, in this browser

Run the lane

Working 0.0s

Result

Findings

Prescan reconciliation

Lane detail

Corrected file — auth.ts

What this file changes

Your past runs