Outside-in review
Assess something you use
Start
How to start
- Copy the review prompt into your AI assistant and name what you want reviewed, or ask in your own words, for example: “Use auditthis.ai to review the browser extension I have installed called Example Helper. I want to know what it can access and what that means for me.” An assistant that reads this site follows the review prompt either way.
- Answer its 5 questions, or reply “use your defaults”. It asks what the target is and which version you have, what you want to decide, what else you keep in the same browser, device, or account (categories only, never account details), whether any of the target's code may run, and whether you have anything you want weighed.
- Read the review. It opens with a plain answer, then shows what the target can reach, the evidence for each point, and what you can do.
Scope
What the review does
- It reads what is published and the copy you already have: for a browser extension, its manifest and code; for an app, the permissions and data statements in its store listing; for any target, its privacy policy, terms, published source, security policy, public advisories, and who publishes it.
- It records the source and date of every piece of evidence, and labels each point with 1 of 5 status labels. A permission the extension declares is DEMONSTRATED; what its code appears to do without running it is REASONED; what only the publisher could show, such as what their servers keep, is UNTESTED.
- It ends with what you can do: settings to change, access to remove or limit, alternatives, and what each costs you in function.
Limits
What it will not do
- It does not test, scan, or probe the publisher's systems. Your request cannot authorize that, because they are not yours.
- It runs none of the target's code unless you choose an option that allows it, and it explains the options first.
- It does not call a product safe, malicious, or compliant. It states the evidence and what it exposes, and lists what remains unknown.
- It does not need your account details, history, or passwords, and it does not repeat any you share.
- It does not give legal advice. If the target's terms forbid inspecting its package, it says so and asks whether to continue with public material only.
Examples
Worked examples
These show how a review proceeds and what its answer looks like. They are illustrations, not findings about any real product.
A browser extension
- You ask
- “Use auditthis.ai to review the 2 shopping extensions I use and tell me which is safer to keep.”
- It reads
- Each extension's manifest (its permissions, the sites it can access, and the scripts it adds to pages), its code where published, its store listing, privacy policy, and publisher; the browser's documentation on what each permission allows.
- The answer shows
- For each extension, a table such as: reads and changes every page you visit, DEMONSTRATED by its declared site access; sends page content to its publisher's server, REASONED from its code; what that server keeps, UNTESTED, with the question to ask the publisher. Then the 2 side by side.
- What you can do
- Limit an extension to the sites it needs where your browser allows it, remove one, or keep it in a browser profile with no banking or work accounts.
A mobile app
- You ask
- “Use auditthis.ai to review the fitness app on my phone. What can it see?”
- It reads
- The permissions and data-safety statements in its store listing, its privacy policy and terms, public advisories, and the OWASP mobile application standard where it applies.
- The answer shows
- What the app may access (location, contacts, health data), what its publisher says it shares and with whom, and which of those statements no one outside the publisher can confirm.
- What you can do
- Deny the permissions it does not need in your phone's settings, turn off background location, or choose an alternative.
An online service or AI assistant
- You ask
- “Use auditthis.ai to review the AI note-taking service our team is considering.”
- It reads
- What the publisher states about security and data handling, measured against a short minimum baseline for software vendors; its privacy policy; for an AI feature, the OWASP list of risks for AI applications.
- The answer shows
- What it would hold of yours, where the publisher meets the baseline on its own statements, and the questions to put to the vendor before adopting it.
- What you can do
- Ask the vendor the listed questions, limit what you connect to it, or, for a formal decision, run the full assessment below.
An open-source project you depend on
- You ask
- “Use auditthis.ai to review the open-source library our product depends on.”
- It reads
- Its repository at a named commit, its security policy and release practice measured against the OpenSSF baseline for open-source projects, and known vulnerabilities in its dependencies, with each tool named and what it sends before it runs.
- The answer shows
- How the project handles security reports and releases, its known vulnerabilities, and which practices its public repository does not show.
- What you can do
- Pin a reviewed version, watch its advisories, or plan a replacement where the gaps matter to you.
Organizations
For organizations
An organization that needs a plan and a full report for an adoption or supplier decision uses the planning prompt and answers its question about the relationship to the project with “outside party”. The plan and the audit then follow section 12 of the method: passive only, from public material and the organization's own copy, with every statement kept within the evidence.