If this Python service failed tonight, would you see it - and is its telemetry safe?
Paste or drop your service - a FastAPI, Flask or Django module, a Celery task, a queue worker. Your browser reads
every file and checks its logs, prometheus_client metrics and OpenTelemetry spans: a card
number or token in a log call, a metric created per request, a label per user id, .labels() calls
that raise, excepts that swallow the error or drop the traceback, spans that never end or report success
for a failure, handlers nothing measures, no request id to tie the lines together. Free, before you sign in, and
nothing is uploaded. Then pick a lane: the audit gives exact edits for each finding, or the
instrument lane writes the whole instrumented file - and the page re-checks both.
The companies, hosts and values in the examples are invented. The first three are audits (the first also carries a saved instrument run of its edited code, one click after the audit), the last an instrument run; each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
The audit rates logs, metrics, traces and correlation, confirms or dismisses every flag below, adds what rules cannot see, and gives exact before/after edits for each finding - which the page applies to your paste and re-checks.
What this does, and what it does not
The check is a reading of the text, not Python: nothing is imported or run. Each file is lexed so strings and comments are never mistaken for code, its blocks are rebuilt from indentation, and each flag carries the catalogue id it comes from and the line it points at. Checks only see what you paste: middleware, a logging configuration or instrumentation set up in a module you did not paste is outside the check (it is noted, not assumed). Your backends, dashboards and alerts are outside the paste too - the lanes ask rather than assume.
The paid lanes see your paste and the page's facts. Every quote and edit they return is checked against your paste, every edit and every returned file is put back and re-checked, and a reply that repeats a credential from your paste is called out. A paste stays in this browser unless you run a lane - and if your code logs a credential, rotate it whatever you do next. Derived from the agent skill @wshobson/python-observability by Seth Hobson (wshobson/agents, MIT). Sources are listed in llms.txt.