Your code, compiled.
Not interpreted.

3  $setting = $request->body("setting");
4  $value = $request->body("value");
5  $conn->execute("UPDATE ... '" . $value . "' ...");
6  $conn->execute("INSERT INTO audit_log ...");
7  $password = Q_Config::get("db.password");
8  $result = file_get_contents("...?pw=" . $password);
9  Cache::$lastAdmin = Users::loggedInUser();

CRITICAL SQL Injection (line 5)
  SQL via string concat — use parameterized query

CRITICAL Injection (line 5)
  untrusted req.body → SQL execute

HIGH Credential exfiltration (line 7→8)
  reads db.password, sends to external URL

MEDIUM Global state (line 9)
  Cache.lastAdmin leaks between requests

MISSING No auth check on write handler
MISSING No input validation

1. Browser

Paste code in the Playground. See U instantly. No install, no server. Upload a .zip and get a security report.

2. Watch mode

node u-watch.js ./web
Watches your source files, transpiles on change, tracks a manifest. Drop-in for existing projects.

3. Full compile

u2c compile src/ -o server
Transpile → analyze → compile to native binary. Ship a 200KB executable instead of a runtime.

20 Security Analyses

SQL injection, credential exfiltration, data flow taint tracking, sensitive column classification, unbounded queries, TOCTOU, N+1 detection, hardcoded secrets, global state leaks, response over-exposure, missing auth checks, unused queries, unhandled errors.

Risk Scores (0–100)

Every function gets a numeric score. Pure functions score 0. A function that reads SSN + sends to external HTTP scores 87. Prioritize review by score — the LLM auditor only looks at functions above threshold.

DB GRANT Generation

GRANT SELECT(email, display_name) ON users TO role_get_user; — exact minimum-privilege SQL, generated from the queries in your code. No manual role configuration.

Boundary Tests

Auto-generated tests that verify capability boundaries: "get_user does not write to database", "export never calls delete()", "handler only accesses expected tables." 23 tests from 6 files.

GDPR Data Lineage

Machine-generated Article 30 report: which PII columns are read, where they flow, where they exit (email, logs, response). Compliance documentation from code analysis.

Container Hardening

"No outbound HTTP → drop CAP_NET_RAW. No file writes → mount root read-only. No email → remove sendmail." Minimum-privilege container spec generated from capability analysis.

Runs on a phone

A 200KB binary with a webview replaces Electron (300MB) or React Native. Your web app becomes a native app on iOS, Android, Mac, Windows — same code, no framework. The HTTP server runs on localhost; the webview is the UI.

On-device AI inference

Link ggml and run quantized LLMs at native speed — Metal on Apple, Vulkan on Android, CUDA on Nvidia. The same binary that serves your UI runs 7B models at 30 tokens/sec. No TensorFlow.js, no WASM overhead.

Auto-vectorized math

Array operations compile to AVX2/NEON/WASM SIMD automatically. A loop that takes 69ms in Python takes 0.02ms in compiled U. Data science, signal processing, game logic — anything with arrays gets 3,000x faster without changing a line.

Zero-dependency deployment

Copy one binary. No apt install, no pip install, no node_modules, no Docker image layers. The binary IS the deployment. A serverless function that cold-starts in 1ms instead of 500ms. An embedded system with 4MB of flash.

Compliance from code

The compiler traces where PII enters, flows, and exits your program. It generates Article 30 GDPR reports, minimum-privilege DB grants, and boundary tests — all mechanically, from the code itself. Your compliance documentation is always in sync because it's derived, not written.

LLM-ready documentation

UDoc generates docs in 20 languages from the type signatures. Not comments — the types ARE the docs. An LLM auditor reads function signatures and reasons about security without reading the body. The documentation compiles — if it's wrong, the code doesn't build.