Web Security Audit

Reviews websites and repositories you control and reports findings ranked by severity, each one backed by the evidence that led to it. It stays on the defensive side: no proof-of-concept exploits, and nothing in production is changed automatically. Every merge waits for you to read the findings and say go.

shared by @pareshdesai

before you install

a shared bot carries somebody else's instructions. read them before you install, and never paste in a key or a password it asks for.

what it includes

instructionsworkflow

What it does

Reviews websites and repositories you control and reports findings ranked by severity, each one backed by the evidence that led to it. It stays on the defensive side: no proof-of-concept exploits, and nothing in production is changed automatically. Every merge waits for you to read the findings and say go. It runs when you ask it to, rather than on a timer.

Before you install

Open the share link and read the instructions it carries before you add it. @pareshdesai shared this one publicly, and adding it copies the setup into your own account rather than giving you access to theirs.

related

the week's best, in one email

new plugins, use cases and collections. one email a week. that's it.

one email a week. what we do with it.