EARLY ACCESSAI security reviews for GitHub pull requests
Find vulnerabilities before they find you.
CodeGuard reviews every pull request for security flaws, exposed secrets and risky dependencies, explains each finding in plain language, and proposes a fix your developers approve before anything reaches production.
- Built for teams without a security engineer
- Access limited to repositories you select
- Scans run in isolated workers
- Fixes are proposed, never auto-merged
halcyon-pay/payments-api #318
Sample dataAdd order search with merchant filters
SQL injection in order search endpoint
Critical- Category
- Injection · CWE-89
- Location
- line 42
- Introduced in
- This pull request
- Confidence
- 96%
Every pull request reviewed
Security checks run when a PR opens or updates, not in a quarterly audit.
Secrets and dependencies covered
Committed credentials and vulnerable packages are flagged alongside code flaws.
Explained in plain language
Each finding says what an attacker could do, where, and why it matters to you.
Tracked until resolved
A later scan confirms the fix, so “closed” means the risk is actually gone.
The problem
Most vulnerabilities ship in ordinary pull requests.
Small teams merge dozens of changes a week. Without a security engineer reviewing them, flaws that would take minutes to fix before merge become incidents after release: rotated credentials, emergency patches, and security questionnaires that stall a customer deal.
Code review checks features, not attack paths
Reviewers confirm the order search works. Few stop to ask whether the merchant ID in the URL can be swapped for someone else’s.
Scanners report without context
Traditional tools return long lists of warnings with no sense of which are reachable, so teams mute them and real issues slip through with the noise.
Risk arrives through packages and config
An outdated YAML parser, a debug flag left on, a wildcard CORS rule. None look dangerous in a diff, and all are common.
Secrets live forever in git history
Deleting a pasted API key in the next commit doesn’t remove it. Every clone, fork and CI log still has it until it is rotated.
Without a security review
PR opened
Order search endpoint, 6 files
Reviewed for behaviour
Approved, tests pass
Merged and deployed
Query built from URL input
Found weeks later
By a customer, a pentest or an attacker
Unplanned incident work
Patch, rotate keys, notify, explain
With CodeGuard
PR opened
CodeGuard scan starts automatically
Finding explained
SQL injection, critical, line 42
Fix proposed
Parameterised query as a patch
Developer approves
Committed to the same PR
Verified and merged
Re-scan confirms it is resolved
Features
A security reviewer inside your development workflow.
CodeGuard combines automated security analysis with AI that explains and fixes, so small teams get the depth of a security review without slowing delivery.
01
AI Code Security Scanner
Connect a GitHub repository and CodeGuard analyses every change for injection flaws, broken authentication, insecure configuration, exposed secrets and vulnerable dependencies. Each scan runs in an isolated, network-restricted worker, then AI triage ranks results by whether they are actually reachable.
One scan covers code, packages and credentials, so nothing depends on a developer remembering to run three tools.
Results feed Pull Request Reviews
scan · payments-api@9f3c2a1
Sample data- 2 findings
Static analysis
142 changed lines across 6 files
- clean
Dependency audit
318 packages resolved from lockfile
- 1 match
Secret detection
Diff and new commits
- running
AI triage
Reachability and risk ranking
Isolated worker · network restricted · 3 of 4 stages complete
02
Pull Request Security Reviews
Findings are posted where developers already work: as a check on the pull request and as comments on the exact lines that introduced the risk. Teams choose which severities block a merge, and only issues introduced by the PR are raised, not the whole backlog.
Security feedback arrives while the author still has context, which is when fixes are fastest.
Each comment links to AI Fix Recommendations
github.com · pull request #77 · checks
Sample dataCodeGuard / security-review
1 high-severity finding introduced by this pull request
internal/auth/middleware.go · line 28
codeguard High
ParseUnverified decodes the token without checking its signature, so a user can edit their own token to impersonate another account. The middleware treats any well-formed token as trusted.
View suggested fix →
03
AI Fix Recommendations
For each finding, CodeGuard explains why it matters in plain language and drafts a patch that follows your codebase’s patterns: a parameterised query, a verified token, a key moved into the environment. Developers review, edit or dismiss it. Nothing is merged automatically.
Developers learn the secure pattern while fixing the issue, instead of searching for it after a failed audit.
Approved patches are verified by the next scan
proposed patch · config/payments.ts
Sample dataLoads the key from the environment. Rotate the exposed key with the provider before merging.
Payment provider live secret key
sk_live_51Hc••••••••Qx2
9f3c2a1 · config/payments.ts:7
- Revoke key with provider
- Issue new key to secrets store
- Remove from code
Secret Detection
Flags API keys, tokens, private keys and connection strings in diffs and commit history, masks them in the UI, and tracks rotation so a key is only closed once it has been revoked.
pyyaml 5.3 → 6.0.1
Reachable from your code
http-fetcher 1.4.2 → 1.6.0
Reachable from your code
image-resize 0.9.1 → 0.9.4
Not reachable · lower priority
xml-stream 2.1.0 → 2.2.3
Not reachable · lower priority
Dependency Monitoring
Reads lockfiles to find vulnerable third-party packages, shows the version that fixes each one, and separates issues your code actually reaches from those it doesn’t.
Open findings · 30 days
17
−9 vs last month
Security Command Center
One view of open findings across repositories, risk trend over time, unresolved issues by owner and remediation progress, for engineering leads and anyone answering a customer’s security review.
How it works
From pull request to verified fix in four steps.
Step 1
Connect GitHub
Install the CodeGuard GitHub App and authorise only the repositories you want reviewed. Nothing else in your organisation is visible to CodeGuard.
- payments-api
- merchant-dashboard
- marketing-site
Step 2
Automated security analysis
Each pull request triggers static analysis, dependency checks and secret detection inside an isolated worker that is discarded after the scan.
SASTSecretsDependenciesConfigStep 3
AI explanation and priority
AI reviews the raw results, removes noise, ranks findings by reachable risk, and writes an explanation and suggested fix for each.
CRITICAL · reachable
Any caller can read other merchants’ orders by editing the URL.
Step 4
Developers review and fix
The team approves or edits each fix in the pull request. CodeGuard re-scans and tracks every finding until it is verified as resolved before deployment.
- Fix approved
- Committed to PR
- Re-scan: resolved
Interactive demo
Explore the CodeGuard workspace.
A working preview with a fictional payments startup. Filter findings, open one to read the explanation and patch, commit a fix, approve a pull request, run a scan or rotate a secret. All data is sample data.
Halcyon Pay
Team workspace · 6 members
Overview
Open findings
7
across 5 repositories
Critical open
2
need action before merge
Merges blocked
1
pull requests
Secrets to rotate
2
exposed in history
Open findings over time
Oct 18: 25 open1 critical7 high11 medium6 low
AI insight
2 critical findings are open, all introduced in payments-api #318. Committing the suggested fixes and rotating the exposed payment key unblocks the merge.
Activity
CodeGuard blocked merge on payments-api #318: 2 critical findings
09:42Priya Nair applied suggested fix for CG-1172 in #311
09:31CodeGuard scanned merchant-dashboard (main): no new findings
08:15Ade Okafor marked AWS access key in ledger-worker as rotated
YesterdayCodeGuard verified CG-1179 fixed after #204 merged
YesterdayMei Lin accepted risk on CG-1165 for develop branch
Oct 16
Who it’s for
Built for teams that ship fast without a security department.
Early-stage startups
Five to fifteen engineers, no security hire, shipping daily.
- How they use it
- Turn on PR reviews for core repositories and block merges on critical findings.
- Benefit
- Catch the issues an enterprise customer’s security review would find, before they ask.
Software agencies
Teams building and handing over client applications.
- How they use it
- Scan each client repository and share the Command Center view at handover.
- Benefit
- Deliver code with a record of what was checked and fixed.
Growing SaaS teams
Engineering leads answering customer security questionnaires.
- How they use it
- Track open risk across repositories and remediation progress by team.
- Benefit
- Clear answers about how code is reviewed, backed by real history.
Fintech & health-tech teams
Products handling payments or sensitive personal data.
- How they use it
- Prioritise secrets, auth and injection findings on data-handling services.
- Benefit
- Fewer ways for sensitive data to leak. CodeGuard does not certify compliance.
Technology
How We Use Amazon Web Services
CodeGuard is designed around one rule: repository code is never analysed inside the main application. GitHub events enter through a small serverless edge, scan jobs wait in a queue, and each scan runs in its own short-lived, resource-limited container with restricted network access. Amazon Bedrock turns raw scanner output into explanations and proposed patches, and the Command Center reads results from a managed database behind authenticated access.
01
Repository Events
- Amazon API Gateway
- AWS Lambda
Receives GitHub pull request webhooks, verifies their signatures and creates scan jobs.
02
Queue & Secure Storage
- Amazon SQS
- Amazon S3
Buffers scan jobs so bursts of pull requests never overload workers; stores encrypted scan artifacts and reports.
03
Isolated Analysis
- Amazon ECS on AWS Fargate
Runs static analysis, dependency checks and secret detection in isolated, resource-limited containers.
04
AI Intelligence
- Amazon Bedrock
Prioritises risk, explains each finding in plain language and drafts fixes for developer review.
05
Command Center
- Amazon DynamoDB
- Amazon Cognito
- Amazon CloudWatch
Serves findings, status and remediation history to signed-in teams, with monitoring and alerts.
- Amazon API Gateway: Provides the public HTTPS endpoint that receives GitHub pull request and push webhooks.
- AWS Lambda: Verifies webhook signatures, creates scan jobs and runs lightweight orchestration such as posting review results back to pull requests.
- Amazon SQS: Queues scan jobs asynchronously so analysis workers scale with pull request volume and failed jobs can be retried.
- Amazon ECS on AWS Fargate: Runs each repository scan in an isolated, resource-limited container with restricted network access, separate from the application servers.
- Amazon S3: Stores encrypted scan artifacts, raw analyser output and generated security reports.
- Amazon Bedrock: Generates plain-language explanations, risk prioritisation and proposed patches that developers review before applying.
- Amazon DynamoDB: Stores scan metadata, findings, status changes and remediation history for the Security Command Center.
- Amazon Cognito: Handles user sign-in and team access to workspaces.
- Amazon CloudWatch: Collects logs, metrics and alarms for webhook intake, queue depth, scan duration and worker failures.
Progress & early access
Help shape CodeGuard from the first release.
CodeGuard is in its building stage. Early-access teams connect a repository, use the product as it develops and tell us what matters in their workflow.
2026
CodeGuard founded
Defined
First scope: GitHub PR scanning, secret detection, dependency checks, AI explanations
Designed
Isolated scanning architecture on AWS
Now
Early access open for design-partner teams
Next
Infrastructure-as-code scanning and organisation-wide policies
Pricing
Plans for every stage of team.
Pricing is being finalised with early-access teams. Request pricing for your team size.
Starter
Individual developers, freelancers and small projects
- Pull request security reviews
- Secret and dependency checks
- AI explanations for every finding
- GitHub integration for selected repositories
Team
Growing engineering teams shipping every day
- Everything in Starter
- AI fix recommendations as reviewable patches
- Security Command Center across repositories
- Merge-blocking rules by severity
- Remediation tracking and reports
Enterprise
Larger organisations with many repositories and teams
- Everything in Team
- Organisation-wide security policies
- SSO and role-based access
- Custom onboarding and support terms
Team
The Team Behind CodeGuard
Abdullah Abubakar
Founder
Abdullah founded CodeGuard to give startups and small development teams the kind of security review that usually requires a dedicated security engineer. He sets the product direction and runs the early-access program with the teams helping shape the platform.
LinkedInLateef Bukayo
Co-Founder
Lateef co-founded CodeGuard and works alongside Abdullah on building the platform, from repository analysis to the way findings and fixes are presented to developers.
Contact