Xalgorix now reviews your pull requests — free, on GitHub

Security review shouldn't start after code ships. Today it starts on the pull request. The Xalgorix GitHub App is live: install it on a repo and every PR gets an automatic security review, commented right on the diff. No workflow file to maintain, no API key to wire up, no account to create. It's free.

What it does

When you open or update a pull request, Xalgorix reads the changed code and looks for the classes that actually get teams breached — injection (SQL/NoSQL/command/template), broken auth and access control (IDOR/BOLA), SSRF, path traversal, unsafe deserialization, XSS, hardcoded secrets, and weak crypto. It posts a single Xalgorix security review comment with the findings, the file and line, and a concrete fix. On new commits it updates that same comment in place — so it never buries the conversation under a pile of bot noise.

Two ways to trigger it

• Automatically — every time a PR is opened, reopened, or pushed to, the review runs and updates its comment.
• On demand — comment @xalgorix review on any PR. It reacts with 👀 to acknowledge, reviews the current diff, posts a fresh review, and reacts 🚀 when it's done.

Free, and honestly scoped

The PR review is deliberately lightweight: it reasons about the diff you're shipping, fast, and it's free with a per-install rate limit so the free tier stays sustainable. It is not the full product. When you need exploit-verified findings — a real request/response that proves the IDOR or SSRF, not a code smell — that's the hosted scanner and the GitHub Action, which can fail the build on findings it actually reproduced at the severity threshold you set. Think of the App as the always-on first pass, and the scanner as the deep pentest.

Add it to your repo

It takes about thirty seconds. Install the app, pick the repositories it can access, and open your next pull request.

Prefer to gate merges in CI, or want the full methodology? Read the docs for the GitHub App and the Action.