---
title: "Software delivery · Solutions"
description: "QWED Security is a GitHub App that checks every pull request with 20 deterministic engines for leaked secrets, unsafe code and weak build settings."
url: https://qwedai.com/solutions/software-delivery
---

# Check every code change before it merges.

More code is now written with AI help, and reviewers cannot read every line. QWED Security is a GitHub App that checks each pull request with deterministic rules and reports the result where your team already works.

[Contact](https://qwedai.com/contact) [Read the documentation](https://docs.qwedai.com/advanced/qwed-security-rule-catalog)

What QWED checks here

-   Secrets
-   Untrusted input
-   Code patterns
-   Shell commands

With QWED Security and GitHub Action

## The riskiest lines are the easiest to miss.

They look like ordinary code until someone uses them.

Nobody checked any of it

### Without QWED

-   **Leaked credentials** An API key for OpenAI, GitHub, AWS or Stripe is committed along with the code.

-   **Unsafe commands** A script runs rm -rf / or pipes a download straight into a shell.

-   **Weak build settings** A Docker image runs as root or uses :latest, or a CI workflow allows script injection.

Each one checked before it is used

### With QWED

1.  **Leaked credentials** secret\_scan The pull request check fails.

    BLOCKED · DENY
2.  **Unsafe commands** shell\_safety The pull request check fails.

    BLOCKED · DENY
3.  **Weak build settings** docker\_scan, ci\_scan Reported as findings on the pull request.

What is proven correct goes through, with a record of why.

QWED returns the decision; your integration acts on it.

## What QWED checks

20 deterministic engines run against a rule set of 112 rules, all listed in the rule catalogue. No model takes part in the verdict.

-   secret\_scan, entropy\_scan

    ### Secrets

    Thirty rules for exposed credentials, plus high-entropy strings.

-   taint\_analysis, cross\_file\_taint

    ### Untrusted input

    Follows user input across files to sensitive sinks.

-   python\_ast, js\_patterns, go\_patterns, rust\_patterns

    ### Code patterns

    Dangerous calls in Python, JavaScript and TypeScript, Go and Rust.

-   shell\_safety

    ### Shell commands

    Destructive commands and pipe-to-shell installs.

-   docker\_scan, ci\_scan

    ### Containers and CI

    Root containers, floating image tags and script injection in GitHub Actions.

-   lockfile\_scan, dependency\_scan

    ### Dependencies

    Unpinned and risky dependencies in npm and PyPI projects.

## Where it fits

1.  Your AI

    Writes or suggests a code change, and someone opens a pull request.

2.  QWED

    Checks the change with 20 deterministic engines and fails closed on anything unknown.

3.  Your systems

    Results appear as a GitHub check, a pull request comment and SARIF in code scanning.

Good to know

-   A clean result means verified against the QWED rule set, never “proven secure”.
-   Findings on lines the pull request did not change are advisory only.

## Get started

-   ### [QWED Security](https://qwedai.com/platform/security)

    A GitHub App. Install it from the GitHub Marketplace and configure it with a .qwed.yml file.

-   ### [GitHub Action](https://qwedai.com/platform/github-action)

    Scan for secrets, unsafe code and unsafe shell commands in your own workflows.

### Shipping code written with AI help?

Tell us what your AI does and where a mistake would hurt.

[Contact](https://qwedai.com/contact)

## Other fields

-   [Banking and payments](https://qwedai.com/solutions/banking)
-   [Legal](https://qwedai.com/solutions/legal)
-   [Tax](https://qwedai.com/solutions/tax)
-   [Cloud infrastructure](https://qwedai.com/solutions/cloud)
-   [AI agents](https://qwedai.com/solutions/ai-agents)