Playground / the analyzer, compiled for your browser

Paste a plan. Watch it hit the ceiling.

This is the analyzer itself, compiled to WebAssembly and running on this tab. Same parser, same rules, same catalog, same report, down to the escapes. Nothing is sent anywhere and nothing is stored.

Your plan is read in this tab and is gone when you close it. There is no server in this loop: the module below is the whole of it.

plan.json

Nothing pasted yet.

or press Ctrl Enter

The screen prints what the CLI prints, which is English in every locale, because that is the text the tool actually emits.

headroom analyze

The browser is the try. The pipeline is the point.

A ceiling you find once is a fact. A ceiling you find on every pull request is a gate. The binary is one static file, it needs no account, and it exits 1 when a finding matches what you asked to fail on.

$ curl -fsSL https://headroomcli.com/install.sh | sh

# .github/workflows/plan.yml
terraform plan -out=tfplan
terraform show -json tfplan > plan.json
headroom analyze --fail-on critical plan.json

There is no size limit on the binary and no browser to keep responsive, so it takes plans this page would refuse.

what this page sends

What this page sends, in full.

Your plan is not in it, and neither is any name from it. Counts are, because they are the only way to learn which clouds and which ceilings people actually bring. Here is the whole list, and the button below shows the exact document that left this tab.

Counted: How many resources, of which Terraform types, under which clouds, and which rule ids fired at which severity.
Never counted: No resource name, no address, no CIDR, no identifier, no finding text, and no fragment of the document you pasted.
Never stored: No cookie, no visitor id, no address of yours. The country your request arrives from is recorded, and nothing narrower.
The CLI, separately: None of this is in the binary. The CLI has no telemetry at all.

POST /_count

The module running this

Its digest is printed on the screen after it loads. It is listed in checksums.txt on the release it came from, so you can compare the two and see that this page runs a published build.