xalgorix
Start scanning

github app · free

A security review on every pull request

Install the Xalgorix GitHub App and every pull request gets an automatic security review, commented right on the diff. No workflow file, no API key, no account.

Install free on GitHub→How it works

What it looks for

The classes of bugs that actually get teams breached:

  • Injection: SQL, NoSQL, command and template
  • Broken authentication and access control (IDOR / BOLA)
  • Server-side request forgery (SSRF) and path traversal
  • Unsafe deserialization and cross-site scripting (XSS)
  • Hardcoded secrets and weak cryptography

How it works

  1. 01

    Install on the repos you choose

    Pick repositories in GitHub's install flow. There's no workflow file to maintain and no API key to wire up.

  2. 02

    Open or update a pull request

    Xalgorix reads the changed code and posts one Xalgorix security review comment with the findings, the file and line, and a concrete fix.

  3. 03

    Push again, or ask for a re-run

    New commits update the same comment in place instead of adding bot noise. Comment @xalgorix review to re-run on demand: it reacts 👀, posts a fresh review, and reacts 🚀 when done.

When you need proof, not a code smell

The App is the always-on first pass. For exploit-verified findings, run a Xalgorix Cloud scan against your deployed app, or add the GitHub Action to fail the build only on findings it actually reproduced, at the severity you choose.

Start scanning →See pricing

Questions

Is it really free?
Yes. Diff-scoped pull request reviews are free and need no Xalgorix account or API key. Each installation is rate-limited so the free tier stays sustainable.
Does it prove the vulnerabilities it reports?
No. The App reasons about the diff quickly, as a first pass. When you need proof, such as a real request and response that demonstrates an IDOR or SSRF, use a Cloud scan or the GitHub Action, which fails the build only on findings it actually reproduced.
What happens to my code?
To review a pull request, the changed code is sent to our AI model provider for analysis. The Privacy Policy explains what we share and with whom, and the Security page lists our current sub-processors.
Will it flood my pull requests with comments?
No. Automatic reviews keep one comment per pull request and update it in place when you push new commits. Commenting @xalgorix review posts a fresh review on demand.

Read the Privacy Policy and Security page, or install from the App's GitHub page.