Skills
The caddie picks the club.
You never configure these. The agent reads the repository, works out what it is, and loads the review skills that apply. A Stripe integration gets the webhook skill. A CLI does not.
Selection is the product.
A scanner that runs every rule against every repository is how you get four hundred findings and no signal. The agent reads the codebase first and runs only what applies, which is why the list below lights up differently per project.
Auth & sessions
Tokens accepted from the wrong place, sessions that never expire, missing authorization checks between authenticated users.
Secrets handling
Keys committed to the repo, secrets read into logs, credentials passed through shell interpolation or query strings.
Dependency risk
Pinned versions with known advisories, and whether your code actually reaches the vulnerable path.
Input validation
Request bodies trusted without parsing, type coercion at trust boundaries, unbounded input reaching expensive work.
Error handling
Stack traces returned to clients, errors swallowed silently, failure paths that leave state half-written.
Data exposure
Personal data in logs, over-broad API responses, internal identifiers leaking into public payloads.
Performance
Queries inside loops, missing indexes on filtered columns, work done per request that could be done once.
Payments & webhooks
Unverified webhook signatures, non-idempotent handlers, amounts trusted from the client.
Rate limiting
Endpoints that cost money or send mail with nothing in front of them, and limits keyed on something a caller controls.
File uploads
Content type trusted from the client, unbounded sizes, user-controlled paths reaching the filesystem.
SQL & ORM
String-built queries, raw fragments taking user input, and transactions that do not cover what they should.
CORS & headers
Origins reflected back wholesale, credentials allowed on wildcards, missing headers on responses that need them.
Clean means nothing we looked for turned up. It does not mean nothing is there.
Did you run it through a caddie?
The GitHub app is not built yet. Nothing here can be installed or bought. Leave an address and we will write when there is something to try.