Know beforeyour clients do.

I build free, open-source tools that check a site after every change and show what broke.

Install the set
  • macOS, Linuxcurl -fsSL https://rythm.sh/install | sh
  • Windowsirm https://rythm.sh/install.ps1 | iex

Every download is checked against signed checksums.

How to verify (opens in a new tab)

TunerIs my site safe?

Finds leaked secrets, exposed files, known CVEs and weak configuration on WordPress and PHP sites.

Detects, never exploits. Secrets are always masked.

Start
  • rhythm tuner scan yoursite.com

Tuner Source on GitHub (opens in a new tab)AGPL-3.0

Tuner scanning a test site on this machine: an exposed .env file with its secrets masked, an exposed debug log, plain HTTP and missing headers, scored 41 of 100.
SoundcheckDid my change break anything?
Snapshots your site in a real browser, then shows what broke after an update or deploy.
Errors, dead buttons, forms, cache leaks, layout and speed.
Start
  • rhythm soundcheck snapshot staging.yoursite.com
  • rhythm soundcheck compare --open
Soundcheck Source on GitHub (opens in a new tab)MIT
Soundcheck comparing a test site after an update: an Add to cart button that no longer does anything, a new JavaScript error on five pages and a new block at the top of three.
EchoIs my site still saying what it should?
Captures every email, SMS, webhook and API call your site sends, then shows what changed after an update.
Seals staging so nothing reaches real people. WordPress, Laravel and Next.js.
Start
  • rhythm echo up
  • rhythm echo install wordpress /var/www/staging
Echo Source on GitHub (opens in a new tab)MIT
Echo comparing a test site after an update: a contact form email that is no longer sent, an SMS with an unfilled name placeholder and a webhook that lost fields.
Contribute
Issues, pull requests and discussions are welcome on each tool.
The tools find it.The workflow fixes it.
Discuss a workflow