Halo scans your codebase for dark patterns, data collection risks, and COPPA 2.0 violations — so you can ship products that protect kids by design.
Security tools find vulnerabilities. Halo finds harm. 160 rules across 16 regulatory frameworks. AST-aware. AI-powered.
Static analysis, AI-powered review, and compliance tracking — in one CLI.
Static analysis with AST-aware intelligence. Halo understands your code's context, traces data flows, and recognizes framework-specific patterns. Next.js, Django, and Rails profiles built in.
AI-powered compliance review by the Halo Review Board. Every violation is assessed with clinical evidence from peer-reviewed developmental psychology research. True positives confirmed. False positives suppressed.
Compliance posture scoring from A+ to F. Track your grade over time. Get regression alerts when new violations appear. Generate PDF compliance reports for audits and board presentations.
| Pack | Rules | Jurisdiction |
|---|---|---|
| COPPA 2.0 | 25 | US Federal |
| UK Age Appropriate Design Code | 15 | United Kingdom |
| EU Digital Services Act | 10 | European Union |
| California AADCA | 15 | US State |
| Australia Online Safety Act | 12 | AU Federal |
| Australia Safety by Design | 6 | AU Federal |
| Utah SB142 | 5 | US State |
| AI-Generated Code Audit | 6 | International |
| Ethical Design Standards | 5 | International |
| EU AI Act (Children) | 15 | European Union |
New packs ship regularly. Custom rule development available for Enterprise.
100 public repositories. 1.5M+ combined GitHub stars. Apps and platforms that children use every day.
3,569 violations. Average: 35+ per repo.
Theoretical penalty exposure across all 100 repos: $189M per day.
Three steps. No signup. No config.
npx runhalo scan .
No signup. No config. Results in under two minutes.
Every finding includes the regulation cited, severity level, developmental context, and a fix suggestion. AST-aware analysis suppresses false positives automatically.
Add Halo to your CI/CD pipeline. GitHub Action runs on every PR. VS Code extension flags issues in real time. Compliance tracking keeps your grade current.
npx runhalo scan . in any directory. Supports JS, TS, Python, Ruby, Go, Java, Swift.
One YAML block. Compliance checks on every PR before merge.
Real-time scanning with AST intelligence. Version 0.4.2 on the marketplace.
--review-board flag for AI-powered violation assessment with clinical evidence citations.
Configure framework profiles, pack selection, severity thresholds, and ignore paths.
JSON, SARIF, HTML, and PDF output. Enterprise-grade compliance documentation.
Start scanning for free. Upgrade when your team needs more.
For individual developers and open source projects.
For teams building products children use.
For teams that need compliance attestation and audit readiness.
For regulated industries, government, and large teams.
All plans include the open-source CLI. Cancel anytime.
Children spend more time inside software than they do in classrooms. The apps they use every day — learning platforms, games, social feeds — are built by engineers who rarely see the regulatory landscape they're shipping into.
We built Halo because we believe the gap between what the law requires and what engineering teams actually know is the single biggest risk to children online. Not malice. Blind spots.
COPPA was written in 1998. The 2.0 update extends protections to kids under 17, with penalties up to $53,088 per violation per day. Most engineering teams have never read it. Most codebases have never been audited against it.
Halo is preventive mental health infrastructure at the code level. We scan source code the way a regulator would — looking for dark patterns, unauthorized data collection, missing consent flows, and age verification gaps — so teams can fix issues before they ship, not after an enforcement action.
Built by Mindful Media in Santa Monica, California. Open source core. Mission-driven.
Two minutes. Free. Before the FTC finds out for you.
Stay updated on new rule packs, regulatory frameworks, and product updates.