QWED Security
A GitHub App built on QWED. It verifies every pull request and release boundary without an LLM, and lets a merge through only on ADMIT.
How it works
Each scan runs an Evidence → Context → Policy pipeline and publishes the result as a Verification Context v1.0 document.
- EvidenceAST parsing, taint reachability, entropy scores and release-boundary manifests.
- ContextEach finding is classified as runtime code, test code, docs, config or a string literal.
- PolicyAdmission rules are evaluated fail-closed and return ADMIT or DENY.
- proof_refA SHA-256 commitment binds the findings and the decision for later audit.
What it checks
Merge gating
The check run passes only on ADMIT. Unverifiable and blocked results fail closed.
Context-aware
Runtime code is separated from tests, docs, string literals and config before any rule runs.
Release boundaries
Python wheels, npm packages and Docker build contexts are checked for what actually ships, including leaked secrets.
AST and taint analysis
Python, TypeScript and JavaScript, Go and Rust, analysed without executing the code.
Diff-aware
A pull request is held to the findings it introduces. Existing issues are recorded as non-blocking context.
Verification Context
Every scan publishes a Verification Context v1.0 document in the pull request.
Example result
A blocked pull request. The decision, the evidence and the blocking finding are all in one machine-readable document.
{ "version": "1.0", "subject": { "repository": "my-org/backend-service", "pull_request": 48 }, "verdict": "BLOCKED", "context": { "decision": { "admission": "DENY", "conclusion": "failure", "reason": "Taint flow reaches unescaped shell execution sink." }, "evidence": { "blocking_findings": [ { "file": "src/server/handler.py", "line": 84, "context": "RUNTIME_CODE", "engine": "taint_analysis", "issue": "Untrusted payload.get('cmd') reaches os.system() sink." } ] } }}Install
- Open the app on GitHub Marketplace and install it on your account or organization.
- Pick all repositories, or only the ones that need merge gating.
- Open a pull request. QWED Security posts a check run with its verdict and attaches the Verification Context.
You can also install it directly from the GitHub App page.
README badge
Show the latest verdict for your repository. Replace owner/repo with yours.
[](https://github.com/marketplace/qwed-security)The badge shows ADMIT, UNVERIFIABLE or BLOCKED and works anywhere Shields-style SVG badges do.
Questions
How is this different from SAST tools such as SonarQube or Snyk?
Rule-based scanners apply the same rules to every line. QWED Security first classifies where a finding lives, separating runtime code from tests and string literals, checks what actually ships in packaged artifacts, and records the result as a Verification Context document bound to a proof_ref.
Will it block pull requests over old code?
No. It is diff-aware: a pull request is accountable only for the lines it adds or changes. Findings in untouched code are listed as non-blocking context.
Does it use an LLM, or send our code anywhere?
No LLM is in the decision path. Scans are AST parsers, taint tracking and policy rules running in an isolated container. Code is not sent to external AI APIs or used to train models.
Which languages and ecosystems are supported?
Python (AST and taint analysis), JavaScript and TypeScript including npm lockfiles, Go, Rust, Dockerfiles, GitHub Actions workflows, and release boundaries for Python wheels and npm tarballs.
How do we install it?
Install the app from GitHub Marketplace and choose the repositories to protect. Pull requests and default-branch pushes are verified from then on; no configuration file is needed to start.
Using the app is covered by the terms and the privacy policy.