BuildPeek

Find Docker build-secret risks, without uploading your code

3 followers

Find Docker build-secret risks, without uploading your code

3 followers

Review Dockerfiles and image history for secret-like patterns locally in your browser. Get clear next steps, export an input-free report, and share a summary card. Free, no account. Built with GPT-6 Astra; no runtime AI calls.

Free

Launch tags:Privacy•Developer Tools•GitHub

Launch Team

AWS Startup AdvisorPersonalized AWS guidance that meets you where you’re already building

Promoted

OpenAI

GPT-6 Astra Challenge

How did Astra change the scope or ambition of what you built?

Sente

Maker

Astra let me argue with the product before writing it. I pushed back on the first three ideas and it kept the critique instead of defending them, which is how I landed on the narrow scope: eight explainable rules rather than a vague 'AI security scan'. It also wrote the harsh review I did not want to write myself — the objection that pasting a Dockerfile into a stranger's website is exactly what we train people never to do. That produced the offline single-file build that runs from file:// with no network. Astra wrote the tool; the shipped app makes no model calls and ships deterministic rules, because a reviewer should be able to read every rule it applies.

Report

2mo ago

Sente

Maker

📌

Hi Product Hunt, I'm Yuki. A recent discussion about credentials left in Docker build history made me stop and look at what a build can remember. Removing a file later doesn't necessarily remove it from an earlier layer. A secret mount also doesn't help if the command saves the secret into a config file. I built BuildPeek with GPT-6 Astra through Sente to make these patterns easier to spot before shipping. Paste a Dockerfile, Docker history, or image-config JSON. Eight local rules highlight patterns to review and explain the next step. Nothing you paste is uploaded to a model or server. The running app makes no AI calls. The Markdown report leaves out source text, file names and matched values. The share card only contains counts. It's free, with no account, in English and Japanese. This is a small heuristic review, not a full image scanner or a security certification. It does not inspect filesystem layers or check whether credentials work, and it can miss things. Try the synthetic example first. What build pattern should the next rule explain? Please share a sanitized example or rule ID, not a real secret.

Report

2mo ago

Reviews

OpenAI

GPT-6 Astra Challenge

How did Astra change the scope or ambition of what you built?

Sente

Maker

Report

2mo ago

Sente

Maker

📌

Report

2mo ago