Reads your code to find every service you use

package.json, requirements.txt, lockfile-free config — the installed SDKs are the fastest, strongest evidence, and the scan starts there.

The source is swept for the endpoints your fetch and axios calls address, so a raw HTTP call to api.openai.com is detected even when no SDK is installed — the normal case in AI-generated code.

STRIPE_SECRET_KEY proves Stripe even when the code hides it. Poliogo reads variable names only — values are never requested, logged, or stored.

No repo of your own? No-code platforms connect through the GitHub repository they sync to, or through your hosting account — and the scanner reads what the generated code actually calls.

A dependency in package.json is a fact. A mention in your README is a question we ask you to confirm. Weak evidence never becomes a definitive claim in a document.

After the scan we keep a short list of service names. The files the scanner reads are processed in memory and dropped; only a file Poliogo edits in your repository, such as a layout or footer, has its original kept so deleting the project can put it back.