settings — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited settings (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A note-taking app with notebooks, rich text editing, and auto-save. Available as a web app, iOS + Android apps, and a macOS desktop app — all with offline support.
Live: drafto.eu
.enex files with full content and attachment supporteu.drafto/mcp on the MCP Registry[email protected] is polled every 5 minutes by a Mac-mini-resident agent, classified by Claude Code, and synced bidirectionally with GitHub issues; see docs/features/support-agent.mdSee docs/features/ for one brief per functional area (code paths, ADRs, testing).
| Area | Stack |
|---|---|
| Web | Next.js 16 (App Router, Turbopack), React 19, TypeScript, Tailwind CSS v4, BlockNote |
| Mobile | Expo 55, React Native 0.84, expo-router, TenTap editor, WatermelonDB |
| Desktop | React Native macOS 0.81.5, TenTap editor, WatermelonDB (shared with mobile) |
| Backend | Supabase (Postgres + Auth + Storage + RLS) |
| Hosting | Vercel (web), Fastlane → App Store / Play Store / Mac App Store |
| Monitoring | Sentry (errors), PostHog (analytics) |
| Testing | Vitest, Testing Library, Playwright, Jest, Maestro |
| Monorepo | pnpm workspaces + Turborepo |
Architecture deep-dive: docs/architecture/overview.md.
pnpm exec playwright install (for E2E)For mobile dev: Expo CLI, Android SDK, Xcode. For desktop dev: Xcode, CocoaPods (gem install cocoapods), Ruby 3.3.7 via rbenv.
Full first-time setup guide: docs/operations/local-dev-setup.md.
git clone https://github.com/JakubAnderwald/drafto.git
cd drafto
pnpm install
# Configure web env
cp apps/web/.env.local.example apps/web/.env.local
# Fill in NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_ANON_KEY
# Push schema to your Supabase project
supabase link --project-ref <your-project-ref>
supabase db push
# Run the dev server
pnpm devOpen http://localhost:3000.
Dev commands live here. Build / release / deployment commands live in docs/operations/builds-and-releases.md.
| Command | Description |
|---|---|
pnpm dev | Start dev server (all apps) |
pnpm build | Production build |
pnpm lint | ESLint (all packages) |
pnpm format:check | Prettier check |
pnpm test | Unit + integration tests |
pnpm typecheck | TypeScript check |
pnpm migration:check | Check migrations for destructive SQL |
Per-app test commands: docs/architecture/testing.md.
apps/
web/ Next.js web app (App Router)
mobile/ Expo + React Native iOS/Android
desktop/ React Native macOS
packages/
shared/ TypeScript types + constants (@drafto/shared)
supabase/
migrations/
docs/
features/ Per-area briefs (auth, notes, editor, sync, search, MCP, …)
architecture/ System shape (overview, environments, testing)
operations/ Runbooks (local-dev-setup, builds-and-releases, migrations)
adr/ Architecture Decision Records
archive/ Historical plans (not source of truth)Full index: docs/README.md.
All work goes through branches + PRs — see CLAUDE.md for the project conventions (worktree workflow, SOLID, testing requirements, production safety rails). Decisions are recorded in docs/adr/.
Private project.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.