01 · Supporting context
The test fixture passes a command to a subprocess with shell=True. The review identifies the risky call and explains the conditions that could make it exploitable.
Secuarden Code Intelligence · GitHub app
Code security that understands your repository.
Find security risks, understand why they matter and review suggested fixes in your GitHub workflow—with context from your codebase.
A free plan is available through GitHub Marketplace.
GitHub PR reviewAnonymised screenshot of an actual PR review
Inspect a finding and suggested fix →
Repository contextHybrid analysisPull-request feedbackSuggested remediation
One finding, fully explained
From a flagged line
to a reviewable fix.
See how a Secuarden review explains a shell-injection risk, recommends a safer subprocess call and gives the reviewer a next action.
Finding · Explanation · RemediationGitHub review
View full-size screenshot ↗
02 · Why it matters
If the command contains untrusted input, a shell can interpret it as instructions rather than ordinary arguments.
03 · What to change
The review recommends passing a list of arguments with shell=False. The developer can evaluate the guidance, request a fix or explanation, or record a reason for ignoring the finding.
How it works
Security review in
your GitHub workflow.
Install the app
Choose the GitHub account or organisation where you want to use Secuarden.
Enable repositories
Complete onboarding and select the repositories you want analysed.
Review the findings
Inspect risks alongside explanations and the repository context supporting them.
Evaluate the fix
Review suggested remediation, test the change and make the merge decision.
Context behind the finding
The line of code
is only the beginning.
Repository signals reveal languages, dependencies and integrations that help reviewers interpret a finding.
Languages and codebase profile
See the languages and codebase characteristics surrounding the change.
Dependencies and integrations
Inspect dependency pinning and detected connections to databases, services and payment libraries.
Evidence behind the signals
Expand technical signals to inspect their supporting details, then use that context alongside the finding’s explanation.
Technical ContextAnonymised product screenshot
View full-size screenshot ↗
From findings to action
Useful in a pull request.
Visible across repositories.
For developers
Work through inline feedback, understand the explanation and evaluate a suggested fix in the context of the change.
For security teams
Use repository insights and downloadable reports to organise review and discuss findings with the teams responsible for the code.
The reviewer makes the decision.
View full-size screenshot ↗
Start with GitHub
Choose your repositories.
Start your first review.
Explore the free plan and current scan allowances on GitHub Marketplace.
Plan your rollout
Review the requested repository permissions during installation and confirm your organisation’s data-handling requirements before enabling analysis.
Languages listed in the Marketplace’s supported-language section:
JavaScriptTypeScriptPythonPHP
Discuss language coverage and deployment needs →Extend to Change Assurance
A finding identifies risk.
A change record adds the history.
When you need to understand how AI participated in a change, explore the Change Ledger, policy controls and Context BOM. Available evidence depends on the integrations and agent activity captured in your workflow.
Before you connect
A few practical questions.
Does the code have to be AI-generated?
Code Intelligence evaluates code risks. That question is separate from identifying whether an AI agent contributed to the change; lineage is part of Change Assurance.
Is this the same as the free AI activity scanner?
No. The public activity scanner examines commit metadata and AI attribution signals. Code Intelligence is the GitHub app for contextual code analysis and PR feedback.
Does Secuarden apply fixes automatically?
This product provides remediation guidance for review. Treat suggested changes as code that needs validation, tests and the appropriate human approval.
What about private repositories and data handling?
Confirm repository access, retention, model-provider handling and organisational requirements before enabling private code analysis. Contact the team for your deployment’s details and review the app’s requested GitHub permissions.
Does a clean scan mean a change is compliant?
A scan result is one input to review. Compliance and change assurance also depend on applicable requirements, evidence, approvals and other controls.
Secuarden Code Intelligence
Make the next review
more informed.
Start with a repository. Bring code context, security findings and remediation guidance into the conversation.