Keep security review inside the pull request lifecycle.
Winfunc evaluates pull requests against repository-owned review criteria, scans the immutable base and head revisions, and keeps investigation inside the changed-file scope. Findings can be published with location, impact, and remediation context, then checked again through an explicit re-review after the code changes.
- acme
- /billing-api
- /PR reviews
- /#2481
Add admin export endpoint
#2481 · feat/export → main · +48 −6
- Diff scoped
- Traced
- Reproduced
| @@ -9,0 +10,6 @@ router | ||
| 10 | +router.get( | |
| 11 | + "/admin/export", | |
winfuncHighCWE-862 This admin route has no role check. Any signed-in user can export every customer's invoices. Reproduced with a member account. + requireRole("admin"), Commit suggestionDismiss | ||
| 12 | + async (req, res) => { | |
| 13 | + const rows = await exportAll(req.query); | |
| 14 | + res.csv(rows); | |
Security work should end in a decision, not another queue.
Point-in-time reviews fall behind fast release cycles, while noisy checks on every diff become easy to ignore. Teams need bounded review of security-relevant changes, findings anchored to the code under review, and a way to verify a fix without silently expanding scope.
- Code change
- finding and triage
- reviewed fix
From scope to an engineering decision.
Connect a supported repository, define the branches or pull-request workflow to review, provide application context and policies, and agree on which findings or changes should require human attention.
- Scope01
Select security-relevant changes using repository review criteria
- Investigate02
Review the immutable diff with repository and application context
- Investigate03
Publish supported findings against changed lines with remediation context
- Review04
Re-review the updated code and require affirmative evidence of a fix
What your team gets.
- 01A finding anchored to the reviewed diff
- 02Evidence, impact, and remediation context
- 03An explicit fixed or still-present re-review
- A recorded selection decision and the exact base and head revisions
- Findings anchored to lines in the reviewed pull-request diff
- Impact, evidence, and suggested remediation in the review context
- A separate delivery state when publishing a GitHub comment fails
- Re-review verdicts that distinguish fixed from still present
Focus deep review on the changes that matter and give developers a verifiable path from finding to fix.
Measure it
Track selected versus skipped reviews, supported findings, time from finding to decision, publication failures, and the share of re-reviewed findings fixed before merge.
Scope and limits
Coverage depends on the supported languages, repository access, build prerequisites, integrations, and agreed review scope. Engineers review findings and decide what changes ship.
Explore connected capabilities
Bring us your hardest codebase.
We'll bring the proof.
Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.