QWED Security installs statistics

Deterministic security verification for PRs and release boundaries. Evidence → Context → Policy pipeline emits a Verification Context v1.0 document with proof-bound verdicts. Merge gates open only on ADMIT. Full-codebase visibility, PR-scoped gating — blocks only what the PR introduces, not existing debt. No LLM, no heuristics, fail-closed.

Capabilities

• Verification Context v1.0 — Every scan emits a machine-readable document with verdict (VERIFIED / UNVERIFIABLE / BLOCKED), admission (ADMIT / DENY), and a SHA-256 proof reference binding evidence to the decision.

• Merge Gating — Check run succeeds only when admission is ADMIT. UNVERIFIABLE and BLOCKED fail closed.

• Context-Aware Classification — Distinguishes runtime code, tests, docs, literal strings, and config before deciding.

• Deterministic Policy Engine — Evidence → Context → Policy pipeline. No AI scoring, no probabilistic pass logic.

• AST + Pattern Analysis — Detects dangerous execution primitives, unsafe constructs, and security-sensitive patterns.

• ReleaseBoundaryGuard — Verifies what ships in Python, npm, and Docker artifacts. Blocks secret leakage in release surfaces.

• Secret Detection — Flags credentials, tokens, and high-risk data exposure across code and config.

• VC in PR Comments — Full Verification Context published as a collapsible PR comment for audit.

Benefits

• Reduced False Positives — Separates executable risk from inert code (tests, docs, literals). • Fail-Closed — Unknown states never pass silently. • Machine-Readable Evidence — Schema-validated VC contract for downstream tooling. • Explainable — Every finding includes context classification and policy reasoning. • Release Surface Coverage — Enforces security on what actually ships.

Getting Started

• Install the GitHub App • Select repositories • QWED scans pull requests automatically • Review in GitHub Checks: • VERIFIED (ADMIT) → merge allowed • UNVERIFIABLE (DENY) → review required • BLOCKED (DENY) → must fix

Use Cases

• Gate merges on deterministic verification • Block unsafe execution patterns • Detect secrets before they land • Enforce release boundaries for packages/containers • Feed VC documents into compliance pipelines