How it works
Project Doctor is rule-based. Each rule looks for one condition and writes a finding when it holds. There is no AI and no randomness: the same folder gives the same result every time.
JavaScript and TypeScript files are read with a real syntax tree, not with regular expressions. For Python, 7 security rules read the file by pattern and mark their findings as heuristic.
A finding is a claim
Every finding comes with its evidence, and how sure the tool is is written separately: confirmed, likely, possible or a suggestion. Being sure is not a substitute for choosing what to fix first; the order is yours.
Limits
In a browser the limits are 20,000 files, 1.5 MB per file, 100 MB of text read and a 150 MB archive. Anything over a limit is skipped, and the scan says so in its notes.
Browser and command line
The same analysis code runs in both. The difference: in a browser, 4 rules do not run when there is no .git folder, and the result says so. The dependency lookup that uses the network is not in the browser.
Command line
The same scan runs from the command line. Clone and build the repository: git clone https://github.com/mesutkisi11/project-doctor, npm ci, npm run build; then node dist/cli/index.js scan . Step by step: README, Install
What we measured
44 rules are unverified; they are marked on the Rules page. The check for access to someone else's record caught 0 of 11 real fixes. That is why it is off by default.