What this tool will not do
It looks into repositories that may contain malicious code, and it is built on the assumption that what it reads is hostile. That is why the convenient way is usually closed off.
What we keep to
It never downloads anything
No clone, no fetch, no checkout. Some payloads run the moment a folder is opened in an editor. Downloading is already losing.
It never runs anything
No install, no build, no lint against the target. Even package.json is only ever parsed as text.
It cannot talk to the outside
A CSP on the interface makes it impossible to request the addresses embedded in a payload. GitHub calls have their destination pinned in code.
The token never reaches the interface
The token borrowed from gh stays inside the local process. It is not written to a file, and it is masked in logs and records.
Nobody else can reach it
Even in the browser it binds to 127.0.0.1 only. Another device on the same wifi cannot see it.
Payloads are never rendered
HTML and markdown from the target are not rendered. URLs are defanged so they cannot be clicked, and shown as plain text.
The agent gets no write access
The agent reads text an attacker wrote. That text can contain instructions, and a write tool sitting open is the path in.
You press restore, not us
Preview is the default. Running it takes an explicit unlock, and protected branches are never quietly reconfigured.
It never fails silently
A target that failed a check is never painted as clean. Whatever could not be verified is counted and shown where you cannot miss it.
It never edits your other config
Hooking up an AI tool does not mean editing that tool's config for you. It shows you what to paste, and you paste it.
The long version
The above is rewritten for people using the tool. The rules as written for people changing the code, and the reasoning behind each one, live in the repository.
Get started →