product
PR Scans
Security checks on every pull request.
used by
50,000+ pull requests scanned and 2,000+ repositories, including firecrawl, mastra, paperclip, nango.
why
agents produce more code than a reviewer can read. a teammate's change is the same problem at a smaller scale. you cannot keep up by hand.
that is how you get hacked: a workflow that gives a fork write, a package that runs code on install. merge is still the moment you own.
scans
security scan
the diff, on every open and update. workflows, install hooks, secret exfil, unexpected network calls.
supply chain scan
added or upgraded packages when a lockfile or manifest changes. npm, pypi, go, rubygems, and github actions.
how it works
three steps
01 open a pull request. someone opens or updates one. you stay in github.
02 scans start. the security scan runs on the diff. the supply chain scan runs if a lockfile or manifest changed.
03 github gets the verdict. check runs and comments on the exact line. a fail can block merge.
get started
free for open source.
the whole suite, on any public repo. private repos are paid — contact us and we'll set you up.