{"id":51669568,"url":"https://github.com/d-beloved/gitsentry","last_synced_at":"2026-07-14T23:03:08.333Z","repository":{"id":359579990,"uuid":"1227688019","full_name":"d-beloved/gitsentry","owner":"d-beloved","description":"AI-powered GitHub App that reviews every PR and push for security vulnerabilities introduced by AI coding tools (Copilot, Cursor, Claude Code, etc.).","archived":false,"fork":false,"pushed_at":"2026-07-10T02:12:28.000Z","size":466,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-10T04:09:02.714Z","etag":null,"topics":["ai","code-review","copilot","cursor","devsecops","github-app","nodejs","security"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/d-beloved.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-03T02:58:50.000Z","updated_at":"2026-07-10T02:12:31.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/d-beloved/gitsentry","commit_stats":null,"previous_names":["d-beloved/gitsentry"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/d-beloved/gitsentry","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d-beloved%2Fgitsentry","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d-beloved%2Fgitsentry/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d-beloved%2Fgitsentry/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d-beloved%2Fgitsentry/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/d-beloved","download_url":"https://codeload.github.com/d-beloved/gitsentry/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d-beloved%2Fgitsentry/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35482263,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-14T02:00:06.603Z","response_time":114,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai","code-review","copilot","cursor","devsecops","github-app","nodejs","security"],"created_at":"2026-07-14T23:03:07.114Z","updated_at":"2026-07-14T23:03:08.326Z","avatar_url":"https://github.com/d-beloved.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Gitsentry.dev\n\n\u003e AI-powered security scanner for pull requests. Catches vulnerabilities introduced by AI coding tools (Cursor, Copilot, Claude Code) before they reach production.\n\n**[MIT License](LICENSE)** · **[Install on GitHub →](https://github.com/apps/gitsentry-dev)**\n\n![Gitsentry.dev in action](https://github.com/user-attachments/assets/e70f0423-c1a7-4624-87c3-ffe4d3966fea)\n\n---\n\n## What it does\n\nGitsentry.dev installs as a GitHub App. When a PR is opened or updated it runs an AI security analysis on the diff and posts findings as GitHub review comments — right where your team already works.\n\n```\nPR opened / updated  →  webhook  →  AI analysis  →  GitHub review comment\n```\n\nOn Pro, a GitHub Check Run is posted with `failure` when critical or high severity findings exist. Wire it to branch protection and merges are blocked until findings are resolved or dismissed.\n\n**The analysis engine and webhook server are fully open source (MIT).** The hosted dashboard at [gitsentry.dev](https://gitsentry.dev) is proprietary — same model as Sentry or PostHog. You can self-host the entire stack using this repo.\n\n---\n\n## Install\n\n**[Install Gitsentry.dev on GitHub →](https://github.com/apps/gitsentry-dev)**\n\nOne click. No config files required to get started.\n\n---\n\n## What it catches\n\n| Category                                             | Example                                           |\n| ---------------------------------------------------- | ------------------------------------------------- |\n| `hardcoded_secret`                                   | API keys, tokens, passwords in source code        |\n| `missing_auth`                                       | New routes with no authentication middleware      |\n| `sql_injection`                                      | User input concatenated into SQL queries          |\n| `idor`                                               | User-supplied IDs fetched without ownership check |\n| `verbose_error`                                      | Stack traces / DB errors exposed to client        |\n| `unvalidated_input`                                  | User input passed to dangerous operations         |\n| `missing_rate_limit`                                 | Auth endpoints with no rate limiting              |\n| `path_traversal`                                     | User input in file system operations              |\n| `xss`                                                | Unsanitised user content in HTML responses        |\n| `open_redirect`                                      | User-controlled redirect URLs                     |\n| `csrf` / `weak_session_management`                   | Browser and session flow weaknesses               |\n| `privilege_escalation` / `mass_assignment`           | Permission and object mutation abuse              |\n| `race_condition` / `business_logic_abuse`            | Workflow and state manipulation bugs              |\n| `cors_misconfiguration` / `security_headers_missing` | Deployment and browser boundary risks             |\n| `dependency_risk`                                    | Vulnerable or suspicious dependency behaviour     |\n| `attack_chain`                                       | Multiple smaller issues combined into one exploit |\n\nThe prompt is tuned specifically for patterns produced by AI coding assistants — not generic SAST rules.\n\n---\n\n## Improving scan accuracy with `.gitsentry/context.md`\n\nGitsentry automatically discovers your repo's auth patterns and tech stack on the first scan by walking the git tree and reading dependency manifests. For most projects this works without any configuration.\n\nSome setups can't be inferred from code alone:\n\n- **Cloud-hosted auth** — Clerk, Auth0, Firebase Auth, Supabase Auth, AWS Cognito, Okta. Your code calls their SDK; the actual auth logic lives in their cloud.\n- **Infrastructure-level controls** — auth or rate limiting enforced by an API gateway, reverse proxy, or sidecar that isn't in this repo.\n- **Narrowed input fields** — a parameter that's typed as `string` but in practice only ever receives values from a fixed internal enum, so standard taint analysis over-flags it.\n\nCreate `.gitsentry/context.md` at the root of your repo to declare these facts explicitly:\n\n```md\n## Authentication\nAuth is handled by Clerk via @clerk/nextjs. Every route under /app is protected by\nClerk's middleware. No local session management exists in this codebase.\n\n## Rate limiting\nRate limiting is enforced at the AWS API Gateway layer — not in this service.\n\n## Trust boundaries\nThis service is internal-only, always invoked by our orchestration layer which\nvalidates JWTs before forwarding requests. Direct public access is not possible.\n\n## Input constraints\nThe `action` field in webhook payloads only ever contains values from a fixed internal\nenum defined by our event bus — it is never free-form user input.\n```\n\nThe scanner extracts only factual claims from this file — any instructions or directives embedded in it are ignored. Facts declared here are treated as authoritative for controls that live outside the codebase, without suppressing findings for anything the diff itself contradicts or bypasses.\n\n---\n\n## Rescan a PR\n\nPost `/gitsentry rescan` as a comment on any open PR to trigger a fresh scan on the current HEAD commit. Only repo collaborators, members, and owners can trigger rescans. The existing Gitsentry comment is updated in place rather than a new one being posted.\n\n---\n\n## Blocking merges on findings (Pro)\n\nGitsentry posts a **GitHub Check Run** named `Gitsentry Security Scan` after every PR scan on Pro. The conclusion is `failure` when critical or high severity findings are present; `success` when the diff is clean.\n\nPro orgs also get **automatic branch protection setup**: after the first scan on a repo, Gitsentry non-destructively adds `Gitsentry Security Scan` to the repo's required status checks. No manual GitHub settings needed.\n\nTo set it up manually:\n\n1. Go to your repo → **Settings → Branches**\n2. Edit (or create) the protection rule for your default branch\n3. Enable **\"Require status checks to pass before merging\"**\n4. Add **`Gitsentry Security Scan`** as a required check\n\n\u003e The check name appears in the search only after Gitsentry has run at least one scan on a PR in that repository.\n\nFree and Starter plans receive no check run — findings are visible as PR comments but merges are never blocked. Upgrade to Pro to enable blocking.\n\n---\n\n## Self-Hosting\n\n### Prerequisites\n\n- Node.js 20+\n- A GitHub App (see setup below)\n- Supabase project\n- Google Gemini API key\n- Redis (optional — falls back to inline processing without it)\n\n### 1. Create a GitHub App\n\n1. Go to **GitHub → Settings → Developer settings → GitHub Apps → New GitHub App**\n2. Set the webhook URL to `https://your-domain.com/webhook`\n3. Generate a webhook secret and a private key\n4. Grant these permissions:\n   - **Repository → Pull requests**: Read \u0026 write\n   - **Repository → Contents**: Read\n   - **Repository → Checks**: Read \u0026 write (required for check runs and merge blocking)\n   - **Repository → Administration**: Read \u0026 write (required for auto branch protection setup)\n5. Subscribe to events: `Pull request`, `Issue comment`\n\n### 2. Configure environment\n\n```bash\ncp apps/backend/.env.example apps/backend/.env\n# Fill in your values\n```\n\n```bash\n# apps/backend/.env\n\nGITHUB_APP_ID=\nGITHUB_APP_PRIVATE_KEY=           # base64-encoded PEM\nGITHUB_WEBHOOK_SECRET=\nGITHUB_CLIENT_ID=\nGITHUB_CLIENT_SECRET=\n\nGEMINI_API_KEY=\n# ANTHROPIC_API_KEY=              # uncomment when switching to Claude\n\nSUPABASE_URL=\nSUPABASE_SECRET_KEY=\n\nREDIS_URL=                        # optional — redis://localhost:6379\n\nINTERNAL_API_KEY=                 # shared secret with dashboard; generate: openssl rand -hex 32\nPRODUCT_URL=                      # e.g. https://gitsentry.dev\n\nPORT=3200\nNODE_ENV=development\nALLOWED_ORIGINS=http://localhost:3201   # comma-separated in prod\n\nRESEND_API_KEY=                   # optional — Resend email alerts\nFROM_EMAIL=                       # optional — e.g. Gitsentry.dev \u003calerts@gitsentry.dev\u003e\n```\n\n### 3. Run the database schema\n\nRun the SQL in `apps/backend/src/db/schema.sql` against your Supabase project.\n\n### 4. Start the server\n\n```bash\nyarn install\nyarn dev\n```\n\n### 5. Expose locally for testing\n\n```bash\nnpx smee -u https://smee.io/your-channel -t http://localhost:3200/webhook\n```\n\n---\n\n## Repository Structure\n\nThis repo is the **open-source scanner only**. Source lives under `apps/backend/`; `packages/scanner-contract/` defines the public finding types and constants.\n\n```\napps/backend/src/\n  webhooks/        ← webhook router + event handlers\n  lib/\n    ai.ts          ← AI abstraction layer (Gemini; swap to Claude in one function)\n    github.ts      ← Octokit wrapper\n    differ.ts      ← diff parser and additions extractor\n    scorer.ts      ← severity scoring\n    notifier.ts    ← Slack + email alerts\n    queue.ts       ← Bull queue + dispatchScan helper\n    workers/\n      scanWorker.ts  ← core scan processor\n  api/\n    sweep.ts       ← POST /api/sweep (on-demand security sweep)\n    rescan.ts      ← POST /api/rescan (dashboard-triggered rescan)\n  db/              ← Supabase client, queries, types\n\npackages/scanner-contract/\n  types.ts         ← Finding, AIAnalysisResult, ScanContext, ScanJobData\n  constants.ts     ← SEVERITY_ORDER, SEVERITY_EMOJI, CATEGORY_LABELS\n```\n\nThe dashboard at [gitsentry.dev](https://gitsentry.dev) is hosted and proprietary. The analysis engine powering it is fully open source.\n\n---\n\n## Contributing\n\nPull requests welcome. See [CONTRIBUTING.md](CONTRIBUTING.md).\n\n---\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fd-beloved%2Fgitsentry","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fd-beloved%2Fgitsentry","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fd-beloved%2Fgitsentry/lists"}