🏆 Show off this rank
Add it to a GitHub README or profile — the card updates as the ranking changes:
Repositories (5)
Validate .env files against .env.example or a JSON schema (missing, empty, extra and mistyped variables), flag weak and default secrets, real secrets in example files, and .env files that are committed, in git history or not gitignored. Never prints secret values. CLI, library and GitHub Action. Zero deps.
Hygiene checks for npm/yarn/pnpm workspaces: circular internal dependencies, internal ranges that no longer match, shared dependency drift, duplicate names, public packages depending on private ones, missing package fields and version drift. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.
Third-party script weight and load-cost report for static sites: estimated bytes, requests and main-thread time per page and per vendor, with budgets, plus sync-script, duplicate and preconnect checks. SARIF, Action. Zero deps.
Lazy-loading audit for static sites: below-the-fold images and iframes missing loading=lazy, and LCP candidates (hero images, first images) wrongly lazy-loaded or deprioritised. SARIF, Action. Zero deps.
Validate package.json before you publish: exports/main/types/bin consistency and condition order, targets that do not exist or are not in "files", ESM/CJS mismatches, name/version rules, repository, keywords, license and sideEffects. Text/JSON/SARIF/Markdown, allowlist with expiry, GitHub Action. Zero deps.