Deterministic security verification for pull requests & release boundaries.
Evidence → Context → Policy pipeline. Every scan emits a machine-readable Verification Context v1.0 document with proof-bound verdicts. Merge gates open only on ADMIT. Zero LLMs. Zero hallucinations. Fail-closed.
proof_ref: sha256:7f83b1657ff1fc53b92dc18148a1...
Every decision bound to a cryptographic proof reference.
Verification Context v1.0 standardizes security evidence for automated pipelines.
Unlike traditional linters that return arbitrary console logs, QWED Security emits a structured, schema-validated Verification Context v1.0 document on every pull request.
Evidence Layer
AST parsing, taint reachability, entropy scores, and release boundary manifests.
Context Classification
Categorizes file context as RUNTIME, TEST_CODE, DOCS, CONFIG, or LITERAL_STRING.
Deterministic Policy
Evaluates admission rules strictly fail-closed. Emits ADMIT or DENY.
SHA-256 Proof Reference
Cryptographically binds all findings and decisions for compliance audit trails.
{
"version": "1.0",
"schema": "https://schema.qwed.dev/verification-context/v1.0.json",
"timestamp": "2026-08-14T12:00:00Z",
"subject": {
"repository": "QWED-AI/qwed-verification",
"pull_request": 312,
"head_sha": "9a2f7c8b1d4e6f0a3c5b8e9d1a2f4c6e8b0a2d4f",
"base_sha": "e1b2c3d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0"
},
"verdict": "VERIFIED",
"context": {
"decision": {
"admission": "ADMIT",
"conclusion": "success",
"reason": "All 18 deterministic engines passed with zero blocking findings."
},
"evidence": {
"files_scanned": 6,
"engines_evaluated": 18,
"blocked_count": 0,
"advisory_warnings": 0,
"suppressed_count": 3,
"proof_ref": "sha256:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
}
}
}Engineered for high-assurance engineering teams.
Zero heuristics. Zero fuzzy matches. Explicit verdicts only.
Deterministic Merge Gating
Check run succeeds only when admission is ADMIT. UNVERIFIABLE and BLOCKED fail closed. Zero probabilistic pass logic.
Context-Aware Classification
Distinguishes executable runtime code from test suites, docs, string literals, and config before applying rules.
ReleaseBoundaryGuard
Verifies package surfaces for Python wheels, npm packages, and Docker build contexts to block secret leakage in production artifacts.
AST & Taint Analysis
Deep syntactic AST and taint flow tracking across Python, TypeScript/JavaScript, Go, and Rust without running untrusted code.
Diff-Aware Pre-Existing Isolation
Holds PRs accountable only for new findings introduced in the diff. Legacy debt is cataloged as non-blocking advisory context.
Verification Context v1.0 & Attestation
Every scan publishes a full Verification Context v1.0 document in PR comments, cryptographically bound to a SHA-256 proof reference.
Add the QWED Security Badge to your README
Showcase deterministic verification status to your contributors and users. Badges are dynamically updated on every merged PR and cached globally at Cloudflare edge network (<20ms).
Why deterministic verification beats probabilistic LLM bots.
Security requires mathematical certainty, not plausible text generation.
| Feature | QWED Security | LLM PR Reviewers | Legacy Regex Linters |
|---|---|---|---|
| Verification Model | Deterministic AST + Policy Engine | Probabilistic Token Generation (LLM) | Static Regex Pattern Matchers |
| Failure Mode | Fail-Closed (Unknown = DENY) | Fail-Open (Hallucinates Safety) | No Admission Model |
| Context Awareness | Tests / Docs / Literals / Release Isolated | Treats all text as prompt context | Dumb string matching |
| Release Boundary Scan | Wheel / npm / Docker package audits | None (Inspects diff only) | None |
| Cryptographic Proof | SHA-256 Proof Reference + Attestation | None (Unreproducible outputs) | None |
| Scan Speed | < 2.0s Average (Deterministic) | 30s - 120s (API Latency & Queues) | < 1.0s (Regex) |
| Audit Trail | Verification Context v1.0 JSON in PR | Unstructured Markdown commentary | Plain CLI exit codes |
Get deterministic security gating in three steps.
No complex YAML configurations required to get started.
Install the GitHub App
Click "Install on GitHub Marketplace" and authorize the QWED Security app on your organization or personal account.
Select Repositories
Choose all repositories or select specific high-assurance repos that require automated deterministic merge gating.
Automatic PR Scans
Open any pull request. QWED scans the diff in <2s, posts check run verdicts, and attaches the full Verification Context.
Clear answers on verification mechanics.
Protect your codebase with deterministic security.
Install QWED Security on your GitHub organization today. Free for public open-source repositories.