Hi, I'm Funk, and I built Bishop. Bishop reads each pull request on the repository you pick and comments on possible security holes and lawsuit risks. Each finding has the file and line, a short explanation of why it was flagged, and a suggested fix you can apply yourself. It also reads your git history for keys that were committed in the past and tells you to rotate them. It's a beta, so here is where it stands. Findings are unproven candidates: Bishop doesn't run exploits, and it doesn't open fix pull requests yet. That's what I'm building next, with every fix opened as a pull request for you to review before anything is merged. For some possible SQL injection and unescaped HTML candidates, a short excerpt of the code goes to a third-party language model provider, with detected keys masked. The Privacy page names the provider and lists what is stored and who processes it. I ran it on OWASP Juice Shop and checked every finding by hand: 6 of the 7 security findings it flagged were real. That's a small sample, so please read it as a first data point. It's free for one repository per GitHub installation. If you try it, I'd like to hear which findings were wrong or confusing.

risk checks for indie apps

Security and lawsuit-risk comments on your pull requests

Security and lawsuit-risk comments on your pull requests