27 analyzers scan your code for security vulnerabilities, architecture violations, AI-generated patterns, custom taint rules, and compliance gaps. Results appear directly in your PR.
Your code never leaves your GitHub runners. Zero third-party access.
Every pull request is scanned automatically. Findings include file, line number, severity, and remediation steps.
This is a real PullGuard report. Every pull request gets this level of detail — grade, risks, costs, remediation steps.
Grade B (31/100) · 624 findings · Est. fix cost: $560,256
Health Dashboard
| Category | Grade | Findings | Est. Cost |
|---|---|---|---|
| 🔒 Security | A | 5 | $4,200 |
| 🏗️ Architecture | C | 18 | $56,784 |
| 📊 Quality | B | 57 | $25,116 |
| 📦 Dependencies | A | 1 | $1,560 |
| 📝 Naming | A | 28 | $2,205 |
Top Risks
| Sev | File | Issue | Est. Cost |
|---|---|---|---|
| 🔴 | backend/src/drift-detector.ts | God file: 1894 lines, 17 functions | $3,744 |
| 🟠 | agents/agent_base.py | God file: 847 lines, 52 functions | $3,120 |
| 🟠 | src → routes → auth | Circular dependency across 3 modules | $2,496 |
| 🟡 | config.ts:42 | Hardcoded API secret (entropy 4.2) | $1,560 |
Proven on enterprise Java codebases
PullGuard identified a reflected XSS vulnerability in a Fortune 500 client's codebase before their manual penetration test found it. The pen test had 10 findings — PullGuard caught the 2 that are detectable via static analysis, with zero false positives.
Most teams need Semgrep for SAST + SonarQube for quality + Snyk for CVEs. PullGuard combines all three.
| Capability | PullGuard | Semgrep | SonarQube | Snyk |
|---|---|---|---|---|
| OWASP Top 10 detection | 15 checks | Pro ($) | Enterprise ($) | Yes |
| Inter-procedural taint | N-hop BFS | Pro ($) | Enterprise ($) | Yes |
| Code quality analysis | 13 analyzers | No | Core | No |
| Dependency CVE scanning | 6 ecosystems | No | No | Core |
| Cost estimation | $/finding | No | No | No |
| SOC 2 compliance | 9 controls | No | Enterprise ($) | No |
| AI code detection | 5-signal | No | No | No |
| Self-hosted / air-gapped | Docker | Yes | Yes | Cloud only |
PullGuard surfaces the right information for the right people.
Every hardcoded secret, SQL injection, and CVE — with file and line number. Cross-file taint tracking traces user input to database queries across module boundaries. Remediation deadlines: 7 days for critical, 30 for major.
Dollar amounts on tech debt. "$560K to fix everything, or $3.7K to just fix the god file." Category health dashboard shows which areas need attention. Budget conversations backed by real data, not estimates.
SOC 2 control mapping with PASS/CONCERN/FAIL per control. Automated evidence generation for auditor review. Risk register with remediation deadlines. Compliance trend tracking shows trajectory to Grade A.
Exact fixes with code examples. Not just "fix this" but "here's how." Quick wins highlighted: 12 trivial-effort fixes you can ship today. AI-generated code detection catches vibe-coded patterns that skip error handling.
Add uses: bazza1love/pullguard-action@v1 to your workflow. Free tier, no key needed.
PullGuard scans automatically on every pull request. Results appear in the Actions step summary.
Grade, score, findings, cost estimate, and compliance status — all before merge.
Per repo, not per seat. No surprises.
Volume discount: 10+ repos $79/mo, 50+ repos $59/mo
No account, no email, no credit card. Add one file to your repo.
name: PullGuard on: [pull_request] permissions: contents: read pull-requests: write jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - uses: bazza1love/pullguard-action@v1 # Free: 12 analyzers. Add license-key for Pro (27) or Enterprise (27 + SOC 2)
Add the workflow file above to your repo. That's the entire setup.
PullGuard scans automatically. Grade, findings, and cost estimate appear in Actions.
Add a license key secret to unlock all 27 analyzers, taint tracking, and SOC 2 compliance.
Free tier — no account required. Pro/Enterprise: hello@pullguard.dev