Someone handed you an app built with AI. How do you know what is in it?15 October 2026 · 2 min readMore and more apps are built with AI and handed over: by a freelancer to a client, by an agency to a business, by a founder to an investor doing due diligence. The person receiving the app usually cannot read the code. So how do they know what they were given?An unsigned ZIP tells you nothing. Anyone could have changed a file between the build and your inbox, and nothing in the ZIP would show it.What a signed export isEvery export from SPOE carries a file called PROVENANCE.json and a signature beside it. The manifest lists:

Every file, with a fingerprint (a SHA-256 hash) of its exact contents.

The AI models behind each change: which model wrote it and which model, from a different family, reviewed it, with the model's one-line summary of what changed. Never the prompts people typed.

The project and version it came from, and when it was exported.

The manifest is signed with an Ed25519 key. If one character of one file changes, or the manifest itself is edited, the check fails.How to check oneIn a browser, with nothing to install. Drop the ZIP on spoe.ai/verify. The check runs entirely in your browser, nothing is uploaded, and it tells you whether every file matches and whether the signing key is one spoe.ai publishes.On your own machine, offline. Every export includes the checker itself. With Node installed, run this inside the unzipped folder:node verify-provenance.mjsIt needs no packages and no network.What a valid signature proves

The files are exactly the ones that were exported. Nothing was added, removed or changed since.

They came from a SPOE project, signed by a key spoe.ai publishes.

Each change in the history was written by one model and reviewed by another, from a different model family.

What it does not proveBe precise about this, because a signature is easy to oversell.

It does not prove the code is bug-free or secure. It proves the review happened, not that the review caught everything.

It does not prove the app does what the seller says. Click through it.

It says nothing about changes made after the export. If the code was edited later, ask for a fresh export, or check what changed.

Each export also carries check.mjs, a free scan for the usual security mistakes (keys in the code, unsafe database queries, routes that change data without sign-in). Run node check.mjs beside the verifier for a second, independent look.Why this matters more as AI writes more codeWhen a person wrote every line, you could ask them about it. When a model wrote most of it, the useful questions become: which models, reviewed by what, and is this the code they produced? A signed manifest answers those in a minute, for anyone, without trusting the person who sent it.If you build apps for clients, hand them a signed export and the link to spoe.ai/verify. It is a better answer to "how do I know what I am getting" than any promise. Start free, or see pricing.Pricing · Blog · App ideas · Compare builders · Verify an export · Developer API · Start freeThis page needs JavaScript to run the app itself. Everything above is a plain description of it.