The link goes out with no lock on it
A public URL with no sign in means anyone who sees it can read what is inside. Pasted into a group chat, it travels further than you meant.
unlocalhost your app
Your agent can build the whole thing. It still cannot host it. Say one sentence and get a real link with sign in already in front of it, so only the people you name can open it.
MIT licensedSelf hostableNo auth code to write
your machine
sarahs-todo.unlocalhost.tech$npm run dev
ready on localhost:3000
youdeploy this and let sarah@gmail.com in
The gap
Hosting is the one part your agent cannot do for you
It writes the app, fixes the bugs, and explains the code. Then it stops, because putting something online needs a server, a domain, a certificate, and a login system. So people reach for whatever is fastest, and that is where things go wrong.
Keys end up in the repository
An API key committed by accident is public the moment the repo is. Bots scan for exactly this, and they find it in minutes.
Login gets bolted on at the end
Auth written in a hurry, by someone who has never written auth, guarding real data. It usually looks fine and usually is not.
Security
We would rather block your deploy than publish your keys
Every deploy is read before it runs
We scan the code for committed secrets first. If we find an env file or something shaped like a key, the deploy stops and tells you which file to fix. Nothing goes online.
Sign in is checked at the edge, before a request reaches your app, so there is no auth for you to write and none for you to get wrong. Access starts when you name someone and ends the moment you remove them.
✓ cloned info-arnav/invoice-parser
✓ checked out 8f21c04
✗ refusing to deploy, secrets found
.envenvironment file committed to the repository
src/db.tslooks like a database password
Remove them, add .env to .gitignore, and pass the values
through your agent instead. Nothing was published.How it works
Sign in with GitHub, then say the sentence
Three steps, once. Everything after that is a sentence to the agent you already have open.
Step 1
Your agent sets it up
Paste one sentence into the agent you already have open. It installs unlocalhost itself, then walks you through signing in with GitHub. You never open a config file.
Step 2
Say who gets in
Tell the agent to deploy it and name the email addresses allowed. It pushes the code using your own git access, not ours.
Step 3
Send the link
Your friend opens it, signs in with GitHub or Google, and lands in your app. Everyone else is turned away at the door.
Questions
Straight answers
What do I have to install?
Nothing yourself. Paste one sentence into your coding agent and it adds unlocalhost, signs you in, and tells you when it is ready.
How do I share localhost with a friend?
Tell your coding agent to deploy it and name who should get in. You get back a real link, and only the people you named can open it after signing in with GitHub or Google.
Is this an ngrok alternative with authentication?
Yes. A tunnel gives you a public address anyone with the link can open, and it dies when you close your laptop. unlocalhost gives you a permanent link with a sign in wall in front of it.
Do I have to write any login code?
No. Sign in is handled before a request ever reaches your app, so your code never sees an unauthorised visitor.
What access do you get to my GitHub?
Read only, and only for the repositories you choose. Your agent pushes code with your own credentials. We never hold write access to anything.
Can I run it on my own server?
Yes. It is MIT licensed and the whole platform runs from one compose file on a single machine.
Ship the thing you already built
It is running on your machine right now. Give it an address and a guest list.