Your developer has gone and nobody understands the database
The one developer who built everything has left. The application runs, but nobody dares touch it. What do we actually know?
The git history answers that without AI: how old the code is, how many people worked on it and whether most of the work comes from one person. For each item, the documentation catalogue shows what there is to hand over: how to start the application, the data model, how to roll back a release.
- Check: knowledge with one person, from the git history. Fixed tools, with a planted and a clean test case
- Check: the documentation catalogue, per item present, thin or missing. The model judges, every claim is verified; not yet measured on our gold set
- What you see: who changed what, and per document where we found it. No judgement of the developer who left
An API key sits in the git history
Someone committed a key in a configuration file, noticed, and removed it again in the next commit. The file is clean. The history isn't.
The fixed scan reads the history of your default branch, up to two thousand commits back, including what was removed long ago, and reports the file, the line and the commit. We don't show the value and never send it to an AI model. Our advice is always the same: treat the key as leaked and replace it at the provider.
- Check: secrets in the git history and in the working copy. Gitleaks at a fixed version, with a planted and a clean test case, and a test that the value never leaves the scan
- What we don't do: try the key, or replace it at your provider
- What you can do: replace the key. In your workspace a secret can never be filtered away
A vulnerable package sits three levels deep
You use a package that uses a package that uses a package, and that last one has had a known vulnerability since yesterday. Nobody on your team ever installed it themselves.
Your lockfile records exactly which versions go live, including those of the components of components. The fixed scan matches every version against the public lists of vulnerabilities and known malicious packages, and names the component, the version and the lockfile it sits in. Having no lockfile is a finding in itself.
- Check: vulnerable and malicious components from lockfiles. Osv-scanner at a fixed version, with a planted and a clean test case
- Check: lockfile present. Fixed tools
- To be honest: an advisory published after your last change shows up at the next check. A repeat run on unchanged code is planned
The documentation says something different from the code
The price rules on the wiki are from last year. The code has changed three times since. A new colleague, or an AI assistant, reads the wiki and builds on rules that no longer apply.
The inspection reads document and code side by side. Under our rules, a document that is much older than the code it describes can't be called current; the date comes from git. What the model claims about it is verified against the file and the line before you see it.
- Check: documentation current, thin or missing, per item of the catalogue. A document older than its code is proposed as outdated
- Check: commands and settings in the documentation that no longer exist. Fixed tools, without AI
- Exactly this situation is on the example check, with file and line
AI wrote the code. Who checked the tests?
An assistant delivered a new module with tests in one afternoon. The pipeline is green. But did those tests actually test anything, did they run on the commit that went live, and did a key or an unsafe pattern slip in with them?
We read the evidence from your own CI: which report belongs to this commit, did it pass, and how many tests ran. A green pipeline without tests doesn't count as proof. The fixed scans read the new code for secrets and risky patterns, and our check on AI risks looks for instructions in your repository that lead an assistant astray.
- Check: test evidence from your CI, linked to the commit, with the four states. Tested against recorded responses from the CI systems
- Check: risky code and secrets in the new code. Fixed scans, with a planted and a clean test case
- Check: hidden instructions to an assistant. Fixed tools, with a planted and a clean test case