// github app · free beta

Every pull request, checked before it merges

The same 68 rules as the command line, run on the files each pull request changes. Findings on the lines you changed show up as annotations right in the diff, and one comment explains what to fix, gives the smallest patch and a prompt to paste into Claude Code, Cursor or whatever wrote the code. Push a fix and the comment updates in place.

Install on GitHub →

What happens on a pull request

  1. GitHub tells us a pull request was opened or updated.
  2. We fetch only the changed files at that commit. The repository is never cloned.
  3. The files are scanned in a temporary folder and deleted as soon as the scan ends, usually within a minute.
  4. A SixthWall check appears on the pull request. It fails only for critical findings on changed lines; everything else leaves it neutral so you are never blocked by a warning.
  5. One comment lists the findings with the fix and the prompt. Pre-existing problems in the files you touched are listed separately and never blamed on the author.

What we store

File path, line number, rule id, severity, the Fix Pack text and the score. Never source code. That is enough for the check, the comment, the verified badge and the public project page, which shows the score and counts only. Uninstalling stops scanning immediately. Details on the privacy page.

The verified badge

Once the App has scanned a pull request, the badge for your repository shows the real score from the last scan instead of a number you typed:

README.md
[![Security score](https://sixthwall.dev/api/badge/gh/OWNER/REPO)](https://sixthwall.dev/gh/OWNER/REPO)

Configuration

Defaults work for most projects. Per-repository settings (which severities fail the check, rules to ignore, whether the badge is public) are coming to the dashboard; until then, reply to the pull request comment or contact us and we set them for you.

Beta means

Free while we watch it run on real repositories. The check and the comment are the product; the dashboard, score history and reports from the Pro tier are still being built. If the App misses something or flags a false alarm, tell us and it becomes a test case.