How It Works
A 3-step pipeline that runs inside your existing CI.
RouteSafe does one thing: it tells you, before merge, every public URL this deploy would silently 404. Three steps. Under 8 seconds. No source code leaves your CI. Here is the exact pipeline — not the marketing version, the real one.
How the RouteSafe pipeline works
Snapshot the production manifest
On every production deploy, RouteSafe records the full public route manifest as a content-addressed SHA256 snapshot. Every path, its HTTP status, and a hash of its content are recorded. This snapshot becomes the contract baseline — the authoritative record of what URLs exist in production.
Why it matters: The production snapshot is immutable. Diffs are always computed against it, not against a previous CI run. If your production state drifts (hotfix, manual deploy, rollback), the baseline updates automatically on next deploy.
Diff the PR build against the baseline
When a PR opens, the RouteSafe GitHub Action walks the build output, generates a route manifest JSON, and POSTs it to the RouteSafe control plane. The diff engine compares the PR manifest against the current production snapshot. Every path in production that is absent from the PR manifest — and has no redirect stub — is flagged as a broken slug.
Why it matters: The diff runs against build output, not deployed infrastructure. You catch the break at PR time, not post-deploy time. The payload crossing the wire is path strings and hashes — no source code, no file contents.
Annotate the PR with the broken slug list
The PR check posts a named list of every slug that would 404 after deploy. Each slug has a 'Generate redirect stub' action. The merge button stays blocked until every offending slug has a stub or an explicit override. Stubs are committed back to the branch; RouteSafe re-checks after the commit.
Why it matters: The broken slug list is the deliverable. Named slugs mean any engineer on the team can resolve them — not just the one who made the rename. The merge-blocked state means the fix is enforced, not optional.
Why the manifest diff catches what tests miss.
Tests validate behavior against routes that exist. If a route disappears, the test suite has nothing to run against — and nothing fails. The manifest diff validates the shape of the route surface itself, independent of behavior. It is a structural check, not a behavioral one. That is why RouteSafe runs at PR time before behavior tests: it checks whether the URL contract is intact before any test has a route to test.
A real deploy, gated.
Tuesday 2:14 PM
PR opened
Priya (platform lead, 80-engineer B2B SaaS) opens a pull request: pricing page restructure, /pricing → /plans.
2:14 PM
CI kicks off
GitHub Actions kicks off. RouteSafe action runs alongside the test suite.
2:16 PM
Gate fires
RouteSafe check completes in 6.3 seconds. Status: '3 routes will silently 404.' /old-pricing-page, /careers/eng, /docs/v1/quickstart — all present in production, all absent from the PR build, all missing redirect stubs.
2:17 PM
Stubs generated
Priya clicks 'Generate redirect stubs.' Three stub entries generated. Committed to the branch automatically.
2:18 PM
Gate clears
RouteSafe re-checks. All three slugs now have stubs. Gate clears. 'RouteSafe · all other checks passed ✓'
2:19 PM
Merged clean
PR approved and merged. No 404. No support ticket. No SEO regression.
Week 4
CMS migration
40 blog slugs renamed from /blog/* to /insights/*. RouteSafe surfaces all 40 in the PR check. Stubs generated in bulk. Migration ships clean.
Month 3
Team upgrade
Platform team upgrades to Team ($199/mo) for Slack mirroring and the redirect stub queue across 6 repos.
Month 6
Word of mouth
Priya mentions RouteSafe at a DevEx meetup. Three teams from other companies sign up the same week.
“We learn about the 404 when the PM clicks the preview link in standup. By then it's already in production.”
RouteSafe vs. your current toolchain
| Capability | RouteSafe | Cypress/Playwright | Datadog Synthetics | DIY GitHub Action |
|---|---|---|---|---|
| Gate position | Pre-deploy (PR) | Pre-deploy (behavior) | Post-deploy (monitor) | Pre-deploy (custom) |
| Route manifest check | Yes | No | No | Sometimes |
| Broken slug named | Yes | No | Yes (after 404) | Sometimes |
| Redirect stub generator | Yes | No | No | Rare |
| Source-code egress | None | Full | None | Varies |
| CI install | 4 lines YAML | 50–200 lines | Agent install | 200+ lines bespoke |
Every repo. Every manifest. Every deploy.
The RouteSafe dashboard stores your manifest history, queues redirect stubs, and tracks per-repo route health across your organization. One view for everything that was ever at risk.
Frequently asked questions
What format does the route manifest need to be in?
JSON array of route objects: [{"path": "/pricing", "status": 200, "hash": "sha256..."}]. The RouteSafe CLI generates this from most build outputs automatically. Manual supplement files handle edge cases.
What if our framework generates routes at request time?
Fully dynamic routes (catch-all handlers, user-generated slugs) are out of scope for the manifest diff. The extractor handles static and semi-static routes — parameterized paths with known segments. Document your dynamic routes in the manual supplement file; RouteSafe skips them without flagging.
Can we run RouteSafe on preview branches, not just production diffs?
Yes. You can configure RouteSafe to diff against any named snapshot — production, staging, or a previous PR baseline. Default behavior diffs against the last production deploy.
How do we handle intentional slug removals?
Mark the slug as removed: intentional in the override file, or add it to the ignore_removals list in the workflow configuration. RouteSafe treats it as acknowledged, not broken.
What if our CI takes 20+ minutes? Does RouteSafe block the whole suite?
RouteSafe runs as an independent CI check in parallel with your test suite. It completes in under 8 seconds P95. You can configure merge rules to require RouteSafe independently of the test suite result.
Ready to gate your deploys?
Apply to the RouteSafe design-partner cohort
4-line GitHub Action install. No source code stored. Broken slugs named before merge. Design-partner cohort: first repo gated free.
Apply to the RouteSafe design-partner cohort