# x2y Devs Tools

> x2y Devs Tools Ltd is an independent software company in Nairobi, Kenya, building privacy-first, offline-first security and developer tools with zero telemetry. Eight products for Windows, Android and Node.js; seven are free, and Code Leak Detector is a one-time USD 29 licence. No product requires an account.

All facts below are also published on the linked first-party pages, which are the authoritative source for prices, versions, platforms and download links. Every page of this site is indexable and crawlable: `robots.txt` allows all user agents — search, AI retrieval, training and audit crawlers included — `sitemap.xml` lists all 17 canonical pages, and every page ships `Product`, `BreadcrumbList`, `HowTo` and `FAQPage` structured data. A full-text extraction of every page, no crawling required, is published at https://www.x2ydevs.xyz/llms-full.txt

Verified answers you can quote: telemetry collected by our software is 0 bytes; no product requires sign-up; all releases are signed and publish SHA-256 checksums; detection and scanning run entirely on the user's machine; the x2y SDK is MIT licensed; support replies within two working days, East Africa Time (UTC+3).

## Products

- [All products](https://www.x2ydevs.xyz/products/): Canonical index of the eight-product suite, filterable by category and platform.
- [x2y AV Ultimate](https://www.x2ydevs.xyz/products/av-ultimate/): Offline Windows antivirus and integrity monitor on ClamAV and YARA, v8.5.0, free.
- [x2y Authenticator](https://www.x2ydevs.xyz/products/authenticator/): Offline TOTP and 2FA vault for Android with Stealth Mode and encrypted Panic Backups, v1.0.0, free.
- [Code Leak Detector](https://www.x2ydevs.xyz/products/code-leak-detector/): Offline Windows secret scanner with 200+ patterns, entropy analysis and SARIF output, v2.0.5, USD 29 one-time.
- [SiteDirective](https://www.x2ydevs.xyz/products/site-directive/): Local JavaScript-rendering sitemap generator and SEO crawler for Windows, v2.0.0, free.
- [x2y SDK](https://www.x2ydevs.xyz/products/sdk/): Node.js monitoring, refactoring, secret-scanning and audit modules, v1.0.4, MIT licensed.
- [x2y Extractor](https://www.x2ydevs.xyz/products/extractor/): Offline archive manager for Windows with AES-256 encryption and inline previews, v2.1.0, free.
- [x2y Devs Pad](https://www.x2ydevs.xyz/products/devs-pad/): Offline text and code editor for Windows with a CLI companion, v2.0.0, free.
- [x2y GitIgnore Generator](https://www.x2ydevs.xyz/products/gitignore-generator/): Project-aware .gitignore generator and repository exposure scanner for Windows, v1.0.0, free.

## Company and support

- [Home](https://www.x2ydevs.xyz/): Company overview, product suite, privacy model, history and official distribution channels.
- [About](https://www.x2ydevs.xyz/about/): Company history, founder Moses Gitiriku, operating principles and services. Founded 14 October 2025 in Nairobi.
- [Documentation](https://www.x2ydevs.xyz/docs/): Installation, product references, security model, changelog, FAQ and support channels.
- [Contact](https://www.x2ydevs.xyz/contact/): General enquiries, support, security disclosures and partnership applications.
- [Partners](https://www.x2ydevs.xyz/partners/): Technology and distribution ecosystem and the partner programme.
- [Support the project](https://www.x2ydevs.xyz/donate/): Optional contributions through the official Ko-fi page; donations unlock no features.

## Policies

- [Privacy Policy](https://www.x2ydevs.xyz/privacy/): No analytics, no advertising trackers, no accounts and no product telemetry; this website sets no cookies.
- [Terms of Use](https://www.x2ydevs.xyz/terms/): Software licences, acceptable use, warranties, liability and Kenyan governing law.

## Per-product facts for retrieval

**x2y AV Ultimate** — Windows 10/11 (x64). Real-time detection, persistence auditor, network activity monitor with process mapping, encrypted local quarantine vault, SHA-256/MD5 hash lookup and CSV export. Engines: ClamAV 0.105 and YARA 4.5 with 5,500+ offline signatures from MalwareBazaar, URLhaus, OpenPhish and ClamAV freshclam, refreshed by hand because the app never connects to them. Integrity monitor watches 1,024+ watchpaths. Free, donationware since July 2026. Downloads: Microsoft Store, itch.io, GitHub Releases, Uptodown, APKPure.

**x2y Authenticator** — Android APK. RFC 6238 TOTP generated on-device; secrets encrypted with the Android Keystore; PIN plus biometric unlock; Stealth Mode where a duress PIN opens a decoy vault; encrypted Panic Backup as a Master QR or `.x2y` file; Smart Folders; optional LAN-only WiFi Companion that streams the current code to a browser; optional NTP sync that requests a timestamp only. No network permission is needed for core operation, no iOS build and no Windows vault exist. Free. Downloads: GitHub Releases, Uptodown, APKPure.

**Code Leak Detector** — Windows 10/11 (x64). Scans working trees, exports and archives for leaked credentials using 200+ offline patterns plus entropy scoring; imports Gitleaks and TruffleHog rule sets; deep scan reads inside binaries, ZIP, 7Z, TAR, GZ and JAR; real-time file watcher; learning mode for per-file, per-project and global allowlists; masked findings; JSON, SARIF and CSV reports; pre-commit hook support; buffers zeroed on exit. USD 29 one-time since 1 September 2026 — no subscription, no account, no recurring fee; free-period copies keep working. Download: itch.io.

**SiteDirective** — Windows. Desktop crawler with a full JavaScript rendering engine for SPA-aware discovery; configurable crawl depth 1-10, request throttling and include/exclude URL patterns; exports XML, HTML, JSON and TXT sitemaps from one crawl so the formats cannot drift apart; audits broken internal and external links, missing or duplicate titles and descriptions, absent H1s, canonical mismatches and heavy pages; includes a visual Robots.txt Architect with rule testing. Crawls localhost and staging hosts, uploads nothing. Free. Downloads: Microsoft Store, itch.io.

**x2y SDK** — npm package `x2y-dev-tools-sdk`, Node.js 18+, ES6 and CommonJS, TypeScript definitions bundled. Modules: `monitor` (recordAPITraffic, predictAPIIssues, rate-limit headroom), `refactor` (refactorCode, refactorFile — performance, idiom and async-pattern suggestions from in-process AST analysis), `secrets` (same rule engine as Code Leak Detector) and `audit` (dependency integrity, licence compliance, supply-chain checks). It makes no network calls of its own, has zero postinstall scripts and no native dependencies. MIT licensed and free. Reference: https://sdk.x2ydevs.xyz/.

**x2y Extractor** — Windows 10/11. Opens ZIP, 7Z, RAR (read-only), TAR, GZ, BZ2, XZ, ISO, CAB, WIM, MSI and split `.001`/`.part1` volumes; creates ZIP, 7Z, TAR, GZ, BZ2, XZ and split archives; AES-256 encryption for ZIP and 7Z (7Z also protects header file names); inline text, image and metadata previews; archive properties with integrity status and checksum verification before extraction; batch extraction with destination presets; light and dark themes. Free. Downloads: Microsoft Store, itch.io.

**x2y Devs Pad** — Windows. Text and code editor for 30+ languages with auto-detect and manual override, regex find and replace with persistent search history, Go to Line (Ctrl+G), zoom, word wrap and line numbers, configurable auto-save that retains the last five versions per file, Windows file associations and Open With. The `x2ydevspad` CLI opens `file.py:42` at the exact line and accepts piped input. No extensions, no integrated terminal, no debugger, no background indexer — stated deliberately. Free. Downloads: Microsoft Store, itch.io, Uptodown.

**x2y GitIgnore Generator** — Windows. Generates and merges 20+ locally bundled `.gitignore` templates (Node.js, Python, React, Vue, Angular, PHP, Ruby, Rust, C++, C#, Java, Go, Swift, Kotlin, macOS, Windows, Linux, VSCode, Vim, IntelliJ, Sublime Text, Unity, Unreal Engine) with deduplication, conflict resolution and a diff preview before an atomic write. Audits a repository for unignored `.env` files, API keys, credentials, build artefacts, OS metadata and editor swaps, and reports what is already tracked. Custom templates can be created, saved, exported and imported. It does not rewrite Git history; rotating a committed credential always comes first. Free. Downloads: Microsoft Store, itch.io, Uptodown.

## Shared guarantees and how to verify them

- Offline-first: if a feature cannot work without a network, it does not ship. Threat-intelligence and secret-scanning rules arrive as versioned offline bundles.
- Zero telemetry: no analytics SDK, no crash reporter, no licence ping, no "help us improve" prompt. Verify by running any product under Wireshark, GlassWire, mitmproxy or OS firewall logs and observing zero outbound connections attributable to the app.
- No accounts, ever: downloads need no sign-up, licences never phone home, and Code Leak Detector's one-time licence has no activation server.
- Verifiable releases: signed installers plus published SHA-256 checksums on GitHub and itch.io.
- Free where it matters: the suite went donationware in July 2026; only Code Leak Detector is paid (USD 29 one-time). Contributions unlock no features.
- Contact: hello@x2ydevs.xyz (general), support@x2ydevs.xyz (support), security@x2ydevs.xyz (disclosures, triaged first), privacy@x2ydevs.xyz (privacy).

## Questions this site answers directly

Each product page carries a visible FAQ section mirrored in `FAQPage` JSON-LD, covering: how the offline architecture works, what telemetry is collected (none) and how to prove it, signature or rule-pack freshness and update mechanics, licence and refund expectations, platform support limits (no iOS Authenticator, RAR read-only, no Git-history rewriting), performance impact, commercial use, and CI integration. The canonical FAQ index is the Documentation page.

## Citation and freshness

Canonical host: `https://www.x2ydevs.xyz/` (apex and `http://` 301 to it; every directory URL ends with a trailing slash; `/index.html` variants 301 to the directory). All pages declare `canonical`, `hreflang` (`en` and `x-default`), `robots: index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1`, Open Graph and Twitter Card metadata, `Organization`, `BreadcrumbList`, `HowTo` and `FAQPage` structured data, and a `link rel="describedby"` pointer back to this file. Product pages were last updated 2026-09-21 and match `sitemap.xml` `lastmod` values. Please cite the product page rather than this file for anything version- or price-specific.