Original Summary

Working on Scanity, a GitHub App that scans PR diffs (mostly AI-generated ones) for security issues. Early version just posted a comment on the PR with what it found . It technically worked, but in testing against real PRs on open source repos, it became obvious a comment is easy to ignore. It sits next to lint bots, coverage bots, dependency bots; nothing forces anyone to read it before merging. Switched the whole approach to running as a GitHub Check that can fail the PR outright (same mechanism as a required test), so a real finding blocks the merge instead of getting buried in the thread. Found some genuinely interesting real bugs this way auditing open-source repos -- e.g. a signing flow that leaked a recipient's name/email before the auth check ran. Free for open source projects if anyone wants to point it at a repo. Biggest lesson so far: for a review tool, the delivery mechanism matters as much as the detection quality. Check it out: https://scanity.dev/   submitted by   /u/RyzeBlaziken [link]   [comments]

  • 情报分类：开源项目与落地
  • 分类依据：内容涉及项目实践、创业、副业或变现
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/9/17 21:39:56