PullGuard — Code Quality, Security & Compliance on Every PR

What PullGuard catches

Every pull request is scanned automatically. Findings include file, line number, severity, and remediation steps.

🔒

Security (15 OWASP Checks)

LLM prompt injection — first-mover AI-SAST, taint-tracked (user input → LLM sink)
SQL injection, XSS, SSRF, command injection, path traversal
Tree-sitter AST parsing (not regex) with N-hop taint tracking across 7 languages (JS, Python, Java, C#, Go, Rust, PHP)
Java deserialization (ObjectInputStream, XMLDecoder, XStream, Kryo)
XXE, CORS misconfiguration, CSP misconfiguration
NoSQL injection (MongoDB/Mongoose find, findOne, updateMany, aggregate)
Custom taint sources & sinks via YAML config
Hardcoded secrets + Shannon entropy analysis
Dependency CVEs across 5 ecosystems (npm, PyPI, Maven, Go, RubyGems)

🏗️

Code Quality

Cyclomatic & cognitive complexity
Dead code & unused exports
Code duplication (Type 1-3 clones)
Monolithic files & deep nesting
Import cycles & architecture violations

🤖

AI & Modern Dev

AI-generated code detection (5-signal scoring)
Breaking change detection (caller blast radius)
Knowledge silo risk (single-contributor files)
Test quality & flaky test indicators
Type coverage gaps

📋

Compliance

SOC 2 security evidence (CC3.1, CC3.2, CC6.1, CC6.8)
PASS / CONCERN / FAIL per control
Per-PR posture delta — "CC3.2 CONCERN→PASS ✅" continuous SOC 2 Type II monitoring
Compliance trend tracking + trajectory prediction to Grade A
Risk register with remediation SLAs (7 days critical, 30 days major)

🔗

Supply Chain & IaC

GitHub Actions security: unpinned actions, pwn-request, script injection, token over-permissions
Git-history secret scan — flags credentials committed then deleted (HEAD-delta verified)
Dockerfile misconfig: runs-as-root, :latest tag, ADD-from-URL, embedded secrets
Dangerous tracked files (.env, .pem, id_rsa, serviceAccountKey.json)
Repo hygiene: SECURITY.md, LICENSE, CODEOWNERS, CI workflow presence
Kubernetes + Terraform coming Q2 2026

💰

Cost Estimation

Dollar amounts per finding & category
Total tech debt cost ("$560K to remediate")
Hours to fix at configurable hourly rate
Top 5 most expensive findings ranked
CFO-ready reports for budget conversations

⚙️

Enterprise

Custom rules in YAML (enforce org policies)
Custom taint rules — define framework-specific sources, sinks, and sanitizers in YAML
API contract validation (OpenAPI drift)
SARIF output for GitHub Code Scanning
Baseline comparison (delta-only on PRs)
Air-gapped deployment (scanner core + legacy/invoice-issued static keys)

What you'll see on every PR

This is a real PullGuard report. Every pull request gets this level of detail — grade, risks, costs, remediation steps.

        PullGuard Report
      
Grade B (31/100) · 624 findings · Est. fix cost: $560,256
Health Dashboard

        
            CategoryGradeFindingsEst. Cost
          

        🔒 SecurityA5$4,200
🏗️ ArchitectureC18$56,784
📊 QualityB57$25,116
📦 DependenciesA1$1,560
📝 NamingA28$2,205

      Top Risks

        
            SevFileIssueEst. Cost
          

        🔴backend/src/drift-detector.tsMonolithic file: 1894 lines, 17 functions$3,744
🟠agents/agent_base.pyMonolithic file: 847 lines, 52 functions$3,120
🟠src → routes → authCircular dependency across 3 modules$2,496
🟡config.ts:42Hardcoded API secret (entropy 4.2)$1,560

      ▶ 🔒 Security Findings (5) — hardcoded secrets, SQL injection, insecure crypto
▶ 💰 Cost Breakdown — $560K total, architecture $56K, quality $25K
▶ 🛠️ Quick Wins (12) — trivial-effort fixes you can ship today
▶ 📋 SOC 2 Security Evidence — 3 PASS, 1 CONCERN

Category	Grade	Findings	Est. Cost
🔒 Security	A	5	$4,200
🏗️ Architecture	C	18	$56,784
📊 Quality	B	57	$25,116
📦 Dependencies	A	1	$1,560
📝 Naming	A	28	$2,205

Sev	File	Issue	Est. Cost
🔴	`backend/src/drift-detector.ts`	Monolithic file: 1894 lines, 17 functions	$3,744
🟠	`agents/agent_base.py`	Monolithic file: 847 lines, 52 functions	$3,120
🟠	`src → routes → auth`	Circular dependency across 3 modules	$2,496
🟡	`config.ts:42`	Hardcoded API secret (entropy 4.2)	$1,560

Before vs. After

Without PullGuard

✓ All checks passed

No code quality, security, or compliance info

"We found the SQL injection 3 months after deploy"
"The AWS key was in the repo for 6 weeks"
"Nobody knew the tech debt was $560K until the audit"

With PullGuard

Grade B · 5 security issues · $560K tech debt

🔴 2 hardcoded secrets · 🟠 1 SQL injection · ⚠️ 3 monolithic files

"Caught the hardcoded secret before it reached main"
"Security team gets findings with file + line number"
"CFO saw the $560K number and approved the refactor budget"

One tool replaces three

Most teams need Semgrep for SAST + SonarQube for quality + Snyk for CVEs. PullGuard combines all three.

✓ Verified parity against 8 competitor categories (73 fixtures) — 100% OWASP parity with Semgrep Pro (18/18)

Capability	PullGuard	Semgrep	SonarQube	Snyk
OWASP Top 10 detection	15 checks	Pro ($)	Enterprise ($)	Yes
Inter-procedural taint	N-hop BFS	Pro ($)	Enterprise ($)	Yes
Code quality analysis	13 analyzers	No	Core	No
Dependency CVE scanning	6 ecosystems	No	No	Core
Cost estimation	$/finding	No	No	No
SOC 2 security evidence	4 controls	No	Enterprise ($)	No
AI code detection	5-signal	No	No	No
Self-hosted / air-gapped	Docker (static key required)	Yes	Yes	Cloud only

Built for every team

PullGuard surfaces the right information for the right people.

🔒 For Security Teams

Every hardcoded secret, SQL injection, and CVE — with file and line number. Cross-file taint tracking traces user input to database queries across module boundaries. Detects pwn-request, script injection, and token over-permissions — the top CI/CD supply-chain attack vectors of 2024–2026. Remediation deadlines: 7 days for critical, 30 for major.

💼 For Engineering Managers

Dollar amounts on tech debt. "$560K to fix everything, or $3.7K to just fix the monolithic file." Category health dashboard shows which areas need attention. Budget conversations backed by real data, not estimates.

📋 For Compliance & Audit

SOC 2 control mapping with PASS/CONCERN/FAIL per control. Automated evidence generation for auditor review. Risk register with remediation deadlines. Compliance trend tracking shows trajectory to Grade A.

👩‍💻 For Developers

Exact fixes with code examples. Not just "fix this" but "here's how." Quick wins highlighted: 12 trivial-effort fixes you can ship today. AI-generated code detection catches vibe-coded patterns that skip error handling.

How it works

Add one line

Add uses: pullguard-dev/pullguard-action@v1 to your workflow. Free tier, no key needed.

Open a PR

PullGuard scans automatically on every pull request. Results appear in the Actions step summary.

Ship with confidence

Grade, score, findings, cost estimate, and compliance status — all before merge.

🔒 Code never leaves your runners

📋 SOC 2 mapped (4 controls, auditor-defensible)

🌐 Air-gapped deployment (static key)

📄 BSL 1.1 licensed (Apache 2.0 in 2030)

Simple pricing

Self-serve for small teams. Enterprise conversations for larger orgs.

Free

forever

✓ 14 core analyzers (incl. dangerous-files & repo-hygiene)
✓ Unlimited public repos
✓ 1 private repo
✓ Grade, score, findings
✗ Security & taint analysis
✗ Cost estimation
✗ SOC 2 compliance

Get Started Free

Pro

$29/mo

per month

✓ 31 of 32 analyzers
✓ 1 private repo
✓ Security & taint analysis
✓ AI-generated code detection
✓ Cost-of-change estimation
✓ SARIF for Code Scanning
✓ Dependency CVE database

Solo developers & single projects.

Team

$99/mo

per month

✓ Everything in Pro
✓ Up to 10 private repos
✓ Up to 20 contributors
✓ All 32 analyzers
✓ Custom rules (YAML policies)
✓ Custom taint sources & sinks
✓ SOC 2 compliance reports

Startups & mid-sized engineering teams.

Enterprise

annual contract

✓ Everything in Team
✓ Unlimited repos & contributors
✓ Priority support (4h SLA)
✓ SSO (SAML / OIDC)
✓ Audit-log export
✓ Dedicated Slack channel
✓ Air-gapped deployment

Contact sales

300+ repos, 100+ developers, regulated industries.

Need more than Team's 10 repos or 20 contributors? Enterprise includes unlimited, dedicated support, and a signed contract.

Get started in 60 seconds

No account, no email, no credit card. Add one file to your repo.

# .github/workflows/pullguard.yml

name: PullGuard
on: [pull_request]
permissions:
  contents: read
  pull-requests: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: pullguard-dev/pullguard-action@v1
        # Free: 14 analyzers. Add license-key for Pro (31) or Team/Enterprise (all 32 + SOC 2 + custom rules)

Copy the YAML

Add the workflow file above to your repo. That's the entire setup.

Open a PR

PullGuard scans automatically. Grade, findings, and cost estimate appear in Actions.

Upgrade when ready

Add a license key secret to unlock all 32 analyzers, taint tracking, supply-chain + IaC checks, and SOC 2 evidence.

View on GitHub Marketplace

Free tier — no account required. Pro/Enterprise: hello@pullguard.dev

Code quality, security & compliance on every pull request

What PullGuard catches

Security (15 OWASP Checks)

Code Quality

AI & Modern Dev

Compliance

Supply Chain & IaC

Cost Estimation

Enterprise

What you'll see on every PR

Before vs. After

Without PullGuard

With PullGuard

One tool replaces three

Built for every team

🔒 For Security Teams

💼 For Engineering Managers

📋 For Compliance & Audit

👩‍💻 For Developers

How it works

Add one line

Open a PR

Ship with confidence

Simple pricing

Free

Pro

Team

Enterprise

Get started in 60 seconds

Copy the YAML

Open a PR

Upgrade when ready

Code quality, security & compliance
on every pull request