27 analyzers scan your code for security vulnerabilities, architecture violations, AI-generated patterns, and compliance gaps. Results appear directly in your PR.
Your code never leaves your GitHub runners. Zero third-party access.
Every pull request is scanned automatically. Findings include file, line number, severity, and remediation steps.
This is a real PullGuard report. Every pull request gets this level of detail — grade, risks, costs, remediation steps.
Grade B (31/100) · 624 findings · Est. fix cost: $560,256
Health Dashboard
| Category | Grade | Findings | Est. Cost |
|---|---|---|---|
| 🔒 Security | A | 5 | $4,200 |
| 🏗️ Architecture | C | 18 | $56,784 |
| 📊 Quality | B | 57 | $25,116 |
| 📦 Dependencies | A | 1 | $1,560 |
| 📝 Naming | A | 28 | $2,205 |
Top Risks
| Sev | File | Issue | Est. Cost |
|---|---|---|---|
| 🔴 | backend/src/drift-detector.ts | God file: 1894 lines, 17 functions | $3,744 |
| 🟠 | agents/agent_base.py | God file: 847 lines, 52 functions | $3,120 |
| 🟠 | src → routes → auth | Circular dependency across 3 modules | $2,496 |
| 🟡 | config.ts:42 | Hardcoded API secret (entropy 4.2) | $1,560 |
PullGuard surfaces the right information for the right people.
Every hardcoded secret, SQL injection, and CVE — with file and line number. Cross-file taint tracking traces user input to database queries across module boundaries. Remediation deadlines: 7 days for critical, 30 for major.
Dollar amounts on tech debt. "$560K to fix everything, or $3.7K to just fix the god file." Category health dashboard shows which areas need attention. Budget conversations backed by real data, not estimates.
SOC 2 control mapping with PASS/CONCERN/FAIL per control. Automated evidence generation for auditor review. Risk register with remediation deadlines. Compliance trend tracking shows trajectory to Grade A.
Exact fixes with code examples. Not just "fix this" but "here's how." Quick wins highlighted: 12 trivial-effort fixes you can ship today. AI-generated code detection catches vibe-coded patterns that skip error handling.
Drop a single YAML file into your repo's .github/workflows/ directory.
PullGuard scans automatically on every pull request. Results appear in the Actions step summary.
Grade, score, findings, cost estimate, and compliance status — all before merge.
🔒 Your code never leaves your GitHub runners. The scan engine runs as a container in your CI. Zero third-party access to your repos.
Per repo, not per seat. No surprises.
Volume discount: 10+ repos $79/mo, 50+ repos $59/mo
Add one workflow file to your repo. That's it.
# .github/workflows/pullguard.yml
name: PullGuard
on: [pull_request]
permissions:
contents: read
pull-requests: write
checks: write
jobs:
scan:
runs-on: ubuntu-latest
container:
image: ghcr.io/bazza1love/pullguard:latest
credentials:
username: ${{ github.actor }}
password: ${{ secrets.PULLGUARD_TOKEN }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- run: node /app/entrypoint.js
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PULLGUARD_LICENSE_KEY: ${{ secrets.PULLGUARD_LICENSE_KEY }}
PULLGUARD_FAIL_SEVERITY: "critical"
PULLGUARD_HOURLY_RATE: "150"Step 1: Create a GitHub PAT with read:packages scope. Set it as PULLGUARD_TOKEN in your repo secrets.
Step 2: Set your license key as PULLGUARD_LICENSE_KEY in repo secrets. Request a key or start with the free tier (no key needed).
Step 3: Open a pull request. PullGuard scans it automatically.