Audits the repository for standard project infrastructure: LICENSE, README, CONTRIBUTING.md, SECURITY.md, .gitignore, CI/CD workflows, and .env.example. Also checks for git hygiene issues: committed secrets files, node_modules, build artifacts, and merge conflict markers left in code. Fast, opinionated, and zero-tolerance for missing basics.
Audits the repository's dependency manifest (requirements.txt, package.json, Pipfile, pyproject.toml) for unpinned versions, missing lockfiles, and known vulnerable package patterns. Does not require internet access — flags structural risks that indicate a vulnerable dependency management posture.
Extrapolates future disasters by mapping proposed code changes against established systemic vulnerabilities.
Interrogates an incident report using the Five Whys framework to extract the uncomfortable systemic root cause. Rejects human error as an excuse.
Scours the repository for past and present sins. Uncovers hardcoded secrets, unresolved vulnerabilities, and systemic technical debt with forensic precision.
Deep-scans every file in a repository for hardcoded credentials, API keys, tokens, and passwords using a library of known credential patterns. Reports findings by severity — CRITICAL for active credentials, ELEVATED for suspicious patterns. Masks actual credential values in output. Never outputs the actual secret — only its location and classification.