Check every code change before it merges.
More code is now written with AI help, and reviewers cannot read every line. QWED Security is a GitHub App that checks each pull request with deterministic rules and reports the result where your team already works.
What QWED checks here
- Secrets
- Untrusted input
- Code patterns
- Shell commands
With QWED Security and GitHub Action
The riskiest lines are the easiest to miss.
They look like ordinary code until someone uses them.
Nobody checked any of it
Without QWED
-
Leaked credentialsAn API key for OpenAI, GitHub, AWS or Stripe is committed along with the code.
-
Unsafe commandsA script runs rm -rf / or pipes a download straight into a shell.
-
Weak build settingsA Docker image runs as root or uses :latest, or a CI workflow allows script injection.
Each one checked before it is used
With QWED
- Leaked credentialssecret_scanThe pull request check fails.BLOCKED · DENY
- Unsafe commandsshell_safetyThe pull request check fails.BLOCKED · DENY
- Weak build settingsdocker_scan, ci_scanReported as findings on the pull request.
What is proven correct goes through, with a record of why.
QWED returns the decision; your integration acts on it.
What QWED checks
20 deterministic engines run against a rule set of 112 rules, all listed in the rule catalogue. No model takes part in the verdict.
- secret_scan, entropy_scan
Secrets
Thirty rules for exposed credentials, plus high-entropy strings.
- taint_analysis, cross_file_taint
Untrusted input
Follows user input across files to sensitive sinks.
- python_ast, js_patterns, go_patterns, rust_patterns
Code patterns
Dangerous calls in Python, JavaScript and TypeScript, Go and Rust.
- shell_safety
Shell commands
Destructive commands and pipe-to-shell installs.
- docker_scan, ci_scan
Containers and CI
Root containers, floating image tags and script injection in GitHub Actions.
- lockfile_scan, dependency_scan
Dependencies
Unpinned and risky dependencies in npm and PyPI projects.
Where it fits
- Your AI
Writes or suggests a code change, and someone opens a pull request.
- QWED
Checks the change with 20 deterministic engines and fails closed on anything unknown.
- Your systems
Results appear as a GitHub check, a pull request comment and SARIF in code scanning.
Good to know
- A clean result means verified against the QWED rule set, never “proven secure”.
- Findings on lines the pull request did not change are advisory only.
Get started
A GitHub App. Install it from the GitHub Marketplace and configure it with a .qwed.yml file.
Scan for secrets, unsafe code and unsafe shell commands in your own workflows.