DEPLOYPROOF

PRE-MERGE BEHAVIORAL DIFF

Preview is a URL.
Proof is a comparison.

Send the same request to preview and production. Catch the status, redirect, header, cookie, and metadata drift that a green build cannot see.

Add to a workflow ↗
NO CREDENTIALS READ-ONLY BODY-SAFE
DEPLOYMENT / #481 COMPARED
PREVIEW feature-auth.pages.dev
VS
PRODUCTION example.com
✓/matches
!/login1 warning
DP005

cookie attributes
preview is missing secure

MERGE BLOCKED

01 / THE GAP

A screenshot can look right while the deployment behaves wrong.

Preview hosts, platform defaults, and environment rules change behavior outside your application bundle. DeployProof treats production as the contract and shows the difference.

02 / COMPARISON

The response surface that matters.

301

Routing

Status, redirect chain, final path, and explicit route expectations.

H

Headers

Cache behavior, content type, CSP, HSTS, frame policy, and CORS-adjacent controls.

C

Cookies

Names and security attributes are compared. Values never enter a report.

⌁

Metadata

Canonical URLs, robots directives, and titles reveal subtle release drift.

03 / CI CONTRACT

Readable locally.
Native in automation.

Human output for the terminal, JSON for tooling, GitHub annotations for pull requests, and SARIF for code scanning.

HUMANJSONGITHUBSARIF
deployproof
$ deployproof --strict

/ ✓ matches production
/docs ✓ matches production
/login
  ! DP005 cookie attributes differ
    preview     [httponly, samesite=none]
    production  [httponly, samesite=lax, secure]

2 matching · 0 errors · 1 warning
SAFETY BOUNDARY

Inspect behavior.
Keep the payload private.

Requests are timed out. Redirects are capped. Readable bodies are size-limited and only parsed for public HTML metadata. Bodies, cookie values, custom request headers, and raw query values stay out of reports.

10sdefault timeout
5redirect limit
500KBbody ceiling

OPEN SOURCE · MIT

Do not hope the preview is equivalent.

Prove it against the deployment your users already trust.