You open a pull requestGuard reads only the files that changed.The rules runLeaked keys, made-up packages, lookalike names and known vulnerabilities.One comment, one checkThe check fails only when something must be fixed now.You push the fixGuard never pushes, merges or deletes. The change is yours.The comment updates in placeThe same comment, now clear, and the check passes.
Pull request 57: orders exportfeat/orders-export → main
package.json · src/config.ts+3
keys: Stripe live secret key sk_live_FwIw•••••••• fix now
packages: reqeusts-helper is not on npm fix now
packages: expres looks like express fix this week
yof Guard commented: 2 to fix now, 1 to fix this week✗ check failed
yof Guard commented · edited: nothing to fix in the changed files✓ check passed
03 Guard · Follows your rules
A guard that follows your rules
Guard is a GitHub App with a rules file. On each pull request it leaves one comment and a check that fails when something must be fixed. It never pushes, merges or deletes anything.
How yof works, shown with sample data
Guardshop-example/shop-web · delete-account → main
Account: delete account endpoint
yof Guard check failed
Findings2
Fix nowapp/api/account/route.ts:20
This change lets anyone delete accounts.
Suggested change. yof never commits it for you.
const { id } = await req.json();+ const user = await currentUser(req);+ if (user?.role !== "admin") return forbidden(); await db.account.delete({ where: { id } });
Fix this weekrequirements.txt · example-http-kit 0.52.1
Update a package to its safe version
.yof.yml
Your rulesBalanced
Code6
Packages3
ignoredocs/**
Your rules file.yof.yml sets the profile and what to skip. The CLI and Guard both read it.
Three profilesRelaxed, balanced or strict. Balanced is the default.
Before every commitA hook checks what you are about to commit, before code leaves your computer.
On every pull requestOne comment, updated in place, and a check that fails when something must be fixed.
Never on its ownNo pushing, no merging, no deleting. You decide.