Free GitHub Action that scans PR diffs for malicious code, not quality

Hacker News

I watched a video recently on malicious code injection into OSS repo PRs and how they can go undetected because of how well they're hidden and decided to do a project for this. This tool is essentially used in unison with ai code review bots like greptile. While tools like greptile reason because they run with LLMs, this is a deterministic step before greptile that scans for malicious code (command execution, credential access, exfil, auto-run hooks, obfuscation, and prompt injection; regex + semgrep, no LLM), then can trigger the ai code reviewer like greptile or coderabbit, pointing it to its findings. It's free/MIT and runs in your CI.

Visit product View on Hacker NewsSep 18, 2026

Share card

Actual performance

2points

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Product HuntOn track for Day 1 leaderboard · Strong signals: code · Missing: mac, agents, macos

86%86% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

best fitHighest predicted score across all platforms for this description.

Indie HackersFits the IH revenue-focused audience · Missing: supports, reddit linkedin, podcasting

54%54% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Strong signals: video · Missing: mobile apps, ios, personal

40%40% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Missing: plus, platform, intuitive

36%36% predicted probability of success on AppSumo, based on ML models trained on real launch data.

Hacker NewsMay not resonate with HN audience · Strong signals: code review, ide, io · Missing: https docs, excited, just released

25%25% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

16%16% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

7%7% predicted probability of success on BetaList, based on ML models trained on real launch data.

Correct prediction on native model

Similar products

GitHub – Specify that a PR must be merged after another PR62%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

GitHub – Specify that a PR must be merged after another PR

Hacker News1

Nextrelease – GitHub Action to publish the next release by merging a PR49%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Nextrelease – GitHub Action to publish the next release by merging a PR

Hacker News2

Asciidoctor GitHub Action32%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Asciidoctor GitHub Action

Hacker News2

GitHub Action to find Log4j vulnerabilities38%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

GitHub Action to find Log4j vulnerabilities

Hacker News2

OpenHands' GitHub Action44%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

OpenHands' GitHub Action

Hacker News2

GitEnforcer – GitHub PR and Issue Quality Assurance Bot48%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

GitEnforcer – GitHub PR and Issue Quality Assurance Bot

Hacker News1

Interactively explore every GitHub PR between 2012 and 201747%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Interactively explore every GitHub PR between 2012 and 2017

Hacker News5

PR Guard – A GitHub Action to ensure authors understand their PRs39%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

PR Guard – A GitHub Action to ensure authors understand their PRs

Hacker News2

PR-Codex, a GitHub app to summarize PR code diffs with ChatGPT43%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

PR-Codex, a GitHub app to summarize PR code diffs with ChatGPT

Hacker News1

OAuth 2.0 Authorization Code Injection Attack in Action41%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

OAuth 2.0 Authorization Code Injection Attack in Action

Hacker News3

Browse all products Analyze your launch