Most tools tell you what changed in your code. This tells you what your application can do: every entry point, what data each one touches, and whether anything checks who is asking. It reads without running anything. No account, no upload, no telemetry, one command writes a single HTML file that works offline. Scan again and it reports what changed about the behaviour, not which lines moved. MIT and free. A paid GitHub Action runs the same check on every pull request, free on public repos.