01 · Supporting context
The example uses a request-supplied name in a database lookup. Concatenation places that input directly inside SQL syntax.
Secuarden Code Intelligence · GitHub app
Code security that understands your repository.
Find security risks, understand why they matter and review suggested fixes in your GitHub workflow—with context from your codebase.
A free plan is available through GitHub Marketplace.
Repository contextHybrid analysisPull-request feedbackSuggested remediation
One finding, fully explained
From a flagged line
to a reviewable fix.
A useful review connects the code, the risk and the next action. Here is what that conversation can look like.
app/search.pyPython · SQLite example
# Before: SQL built from input query = "SELECT id FROM users WHERE name = '" + name + "'" cursor.execute(query) # Suggested change: bind the value cursor.execute( "SELECT id FROM users WHERE name = ?", (name,) )
Illustrative code, not a customer scan result. Parameter syntax depends on the database driver; review and test any suggested change.
02 · Why it matters
An attacker could alter the query rather than simply supply a search value. The impact depends on the query and the database account’s permissions.
03 · What to change
Use the driver’s parameter binding. Add tests for names containing quotes, unexpected input and the intended search behaviour.
How it works
Security review in
your GitHub workflow.
Install the app
Choose the GitHub account or organisation where you want to use Secuarden.
Enable repositories
Complete onboarding and select the repositories you want analysed.
Review the findings
Inspect risks alongside explanations and the repository context supporting them.
Evaluate the fix
Review suggested remediation, test the change and make the merge decision.
Context behind the finding
The line of code
is only the beginning.
Repository context gives reviewers a better starting point for understanding a finding.
Language and framework
Understand the conventions and components around the code being reviewed.
Dependencies and structure
See the libraries and repository organisation that help explain the implementation.
Static signals and AI reasoning
Bring complementary analysis techniques into the review, with explanations a developer can inspect.
CONTEXT MAPIllustrative repository
application/
├── routes/
│ └── search.py
│ Request input
├── services/
│ └── users.py
│ Search logic
├── data/
│ └── database.py
│ Query execution
└── tests/
└── test_search.py
Behaviour checksA simplified explanation of code context, not an assertion of a particular dataflow-analysis capability.
From findings to action
Useful in a pull request.
Visible across repositories.
For developers
Work through inline feedback, understand the explanation and evaluate a suggested fix in the context of the change.
For security teams
Use repository insights and downloadable reports to organise review and discuss findings with the teams responsible for the code.
Start with GitHub
Choose your repositories.
Start your first review.
Explore the free plan and current scan allowances on GitHub Marketplace.
Plan your rollout
Review the requested repository permissions during installation and confirm your organisation’s data-handling requirements before enabling analysis.
Languages listed in the Marketplace’s supported-language section:
JavaScriptTypeScriptPythonPHP
Discuss language coverage and deployment needs →Extend to Change Assurance
A finding identifies risk.
A change record adds the history.
When you need to understand how AI participated in a change, explore the Change Ledger, policy controls and Context BOM. Available evidence depends on the integrations and agent activity captured in your workflow.
Before you connect
A few practical questions.
Does the code have to be AI-generated?
Code Intelligence evaluates code risks. That question is separate from identifying whether an AI agent contributed to the change; lineage is part of Change Assurance.
Is this the same as the free AI activity scanner?
No. The public activity scanner examines commit metadata and AI attribution signals. Code Intelligence is the GitHub app for contextual code analysis and PR feedback.
Does Secuarden apply fixes automatically?
This product provides remediation guidance for review. Treat suggested changes as code that needs validation, tests and the appropriate human approval.
What about private repositories and data handling?
Confirm repository access, retention, model-provider handling and organisational requirements before enabling private code analysis. Contact the team for your deployment’s details and review the app’s requested GitHub permissions.
Does a clean scan mean a change is compliant?
A scan result is one input to review. Compliance and change assurance also depend on applicable requirements, evidence, approvals and other controls.
Secuarden Code Intelligence
Make the next review
more informed.
Start with a repository. Bring code context, security findings and remediation guidance into the conversation.