Install the GitHub App. On every push, NoHack audits the exact head commit for code flaws, vulnerable dependencies, and leaked secrets, and reports only what touches the lines that changed.
Scoped to the change, so the comment stays short.
01 · push
The GitHub App picks up the push on any pull request, including from forks. A newer push cancels the audit of the older one.
02 · audit
Code, dependency, and secret audits run in parallel on the exact commit. The code audit walks the call graph backwards from what changed.
03 · scope
Only findings on changed lines are reported. Deleted code is checked too, because removing a check can be a regression.
04 · report
One comment with a severity summary and a table of findings, updated in place. Line annotations land on the diff.
05 · gate
The check fails on critical, high, or a verified secret; it is neutral on low and medium; it passes when clean.
06 · continuous
With continuous mode on, pushes to the repository trigger delta audits, so the full picture stays current between full audits.
Existing debt doesn’t bury the change under review. What the PR introduced is what the PR is told about.
Each push edits the same comment instead of adding another. The thread stays readable.
Make the NoHack check required in branch protection to block merges on critical findings and verified secrets.
Every PR audit has a time, endpoint, and token ceiling. An audit cut short says so and is never reported as clean.
One comment, one check, and a link to the full finding with its proof.
3 findings on changed lines of 4f1c2e9 · code, dependencies, secrets
| Severity | Finding | Location | Link |
|---|---|---|---|
| Critical | SQL injection in order search | services/order.ts:131 | View |
| High | Verified secret: payment API key | config/payments.ts:7 | View |
| Medium | axios 1.6.0 · CVE-2023-45857 | package.json:23 | View |
Severity counts for the change, so the reviewer knows in one line whether to stop.
Severity, title, and file:line for each finding, each linking to the full proof in the platform.
Fails on critical, high, or a verified secret. Neutral on low and medium. Passes when clean.
GitHub: github.com, GitHub Enterprise Cloud, and GitHub Enterprise Server, through your own GitHub App, set up with a guided flow. Repositories can also be audited from a git URL or a zip upload outside the PR flow.
Not today. Each finding links to its proof and a specific fix inside the platform, where you can ask Aaron to generate a patch.
Audits run asynchronously on the GitHub App’s side with a 20-minute ceiling. Your CI does not wait on it unless you make the check required.
Bring a repository, a web app, or an APK. We will walk you through a real audit of it.