RepoGuard scans every commit for malicious code, blocks dangerous pushes, and opens fix pull requests automatically — before damage reaches your default branch.
Results shown in GitHub check runs and pull requests — no CLI required
RepoGuard plugs into GitHub's event system. No configuration required — it starts scanning the moment you install it.
One click from the Marketplace. Grant repository access and RepoGuard immediately scans your entire codebase for existing threats.
Each commit triggers a scan of changed files. A GitHub Check Run reports the result — clean or blocked — directly in your pull request.
When issues are found, RepoGuard opens a detailed pull request with the patches applied, findings explained, and your repo admins requested as reviewers.
Choose the right setup for your stack — from full 1-click cloud automation to native CI/CD workflows and zero-dependency libraries.
1-click install for organizations and developers. Automatically blocks malicious merges, creates automated Fix PRs, enables the interactive /fix issue command, and sends real-time Slack alerts.
Run threat scans directly in your GitHub Actions runners. Supports PR check annotations, custom .repoguard.yml configs, and zero server infrastructure.
Zero-dependency security engine published on npm with dual ESM/CJS build. Integrate rule scanning directly into pre-commit scripts, custom security CLI tools, or microservices.
Unlike traditional vulnerability checkers, RepoGuard focuses directly on active developer supply chain threat vectors.
| Security Feature | RepoGuard | Dependabot | GitHub CodeQL |
|---|---|---|---|
| Instant scan-on-push hooks | Yes (Blocked) | No (Periodic) | Yes (CI Action) |
| Malware injection rules (RCE, shells) | Full coverage (23+) | None (CVE database only) | Partial static patterns |
| Package typosquatting scans | Yes (100+ signatures) | No | No |
| Interactive post-push Auto-Fix PRs | Yes (Applies diff) | Yes (Updates version) | No |
| Average setup runtime | < 30 seconds | 3 minutes | 15+ minutes config |
Rules are written from real attack patterns — not theoretical threats. Every rule maps to a documented malware campaign or CVE-class vulnerability.
Detects curl|bash and wget|sh patterns — the most common malware delivery mechanism in compromised repos.
Catches bash -i >& /dev/tcp and netcat reverse shell patterns before they reach your default branch.
Identifies base64-encoded eval() chains and obfuscated string array patterns used to hide malicious intent.
exec(compile()) and dynamic __import__() calls — the standard toolkit for PyPI malware campaigns.
Flags pull_request_target with PR head checkout — a well-known GitHub Actions vector for fork-based RCE.
Uses mathematical Shannon entropy scoring (H ≥ 4.3) to catch raw API keys, private keys, and JWTs without keyword reliance.
Detects xmrig, stratum+tcp, and cryptonight keywords injected into CI pipelines and scripts.
Catches environment variable reads combined with outbound HTTP calls — the pattern behind most token theft.
Scans package.json and requirements.txt against 100+ known typosquatted npm and PyPI package names with automated replacement.
Immediately flags .env, .env.production, and .env.local being pushed and offers automated deletion PRs.
Detects package.json postinstall scripts that make network calls — a supply chain attack staging ground.
Detects attempts to hijack internal package scopes with public npm registry uploads.
Everything you need to know about setting up RepoGuard.
Takes 30 seconds to install. Works on every repo, every push, immediately.
Install RepoGuard Free →