How do you check a brand once you find something that looks suitable?
I use a tool called Choice to help research brands, but I'd also like to know about the actual item I'm buying. An organic cotton label doesn't tell me what the person sewing it gets paid.
How do you check that for a particular item? Do brands ever share enough information to trace it back to the factory?
You hear something about a company, think "okay, won't buy from them again," then forget about it by the next time you shop.
I built Choice to help with that. You choose the issues you care about, and it brings up relevant company findings while you're browsing, with links to the sources.
The screenshot shows the Amazon page. You can look through the findings and alternatives yourself.
It's free on Chrome and Firefox: https://youneedchoice.com
Would you use this while shopping, or would you rather look up a company beforehand?
I built Choice, a free site for checking company practices and reading the sources behind each finding.
Here’s an example: https://youneedchoice.com/company/patagonia.com
Its record includes Patagonia’s 1% environmental giving commitment. That tells you about its donations; you’d still need separate evidence about factory conditions.
If you’re considering a clothing purchase, leave the brand and what you want to know. I’ll help you check the available evidence. Coverage is limited, so some questions will stay unanswered.
You can use the website without an account or installation. There’s also a free browser extension if you want company checks while shopping.
I’m trying to understand how devs are handling npm package risk in their Node projects.
A dev or an AI agent adds a new package, npm is about to fetch it, put it in node_modules, and maybe run lifecycle scripts. At that point, are most teams doing anything, or is the normal flow still to install first and rely on CVEs, npm audit, Dependabot, Snyk, Socket, or code review later?
I’m building in this area and I’m trying to get an idea for what others are doing. Do you actually check anything before installing a new dependency, or does that feel unnecessary? Would install time blocking be useful in a real workflow, or would it just become annoying noise? And does the answer change now that Claude, Cursor, Codex, etc. can add packages for you?
I've been using AI coding tools a lot lately and one thing keeps bugging me. They're great at writing code but they're also way too eager to add dependencies. Sometimes that's fine. Sometimes it's a little sketchy. Either way the review ends up on me.
Is this package still maintained? Does it have known vulnerabilities? Any weird install scripts? Is it a typo squat risk? Is it pulling in a massive dependency tree just for one tiny function? Is it even the package I would have picked myself?
I know dependency scanning already exists, but most of it is CVE based or runs after the decision has already been made. By then the package is in the repo, the PR is open, the app is already wired around it. I care about the moment before that, especially when an AI agent is the one suggesting the package.
So I started building something called Dependency Guardian. The idea is simple. Before a package gets added it gives you a risk verdict so you can decide whether to allow it, reject it, or go look for a safer alternative.
To be clear this isn't a CVE lookup tool Dependency Guardian can actually scan the package code itself, so it can catch sketchy stuff that hasn't been reported anywhere yet.
The part I'm unsure about is where this should live. For people building with Cursor, Claude Code, Copilot, Replit, Bolt, Lovable, whatever. Would you want this check before install? Inside the IDE or chat flow? As a GitHub PR comment? A CI check? Or is this just not painful enough to care about until something actually breaks?
Looking for feedback from people using AI tools heavily. Does this feel like a real workflow problem or am I overthinking it?
