Vigil-PR installs statistics

Vigil automatically scans every pull request for security issues introduced by AI-generated code — before it merges. It catches hardcoded secrets, hallucinated package names, and OWASP Top 10 vulnerabilities, posting inline review comments directly on the offending lines with severity ratings and fix suggestions.

What Vigil catches

🔑 Hardcoded secrets — AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe, Slack, private key blocks, JWT tokens, generic passwords, and more (20 patterns). Matched values are redacted in comments to avoid re-exposing secrets.

📦 Hallucinated packages — npm and PyPI packages that don't exist in the registry, flagged before npm install or pip install can deliver malware. AI code generators frequently invent plausible-sounding package names that attackers register to distribute backdoors (slopsquatting).

🛡️ OWASP Top 10 — SQL injection, command injection, weak cryptography (MD5/SHA1/ECB mode), insecure deserialization (pickle.loads, eval), SSRF, JWT algorithm:none, timing-unsafe password comparison, security misconfigurations (debug=True, verify=False, wildcard CORS), and more.

How it works

Vigil is a GitHub App that receives a webhook on every pull request open, update, or reopen event. It scans only the added lines in the diff — not the entire codebase — then posts an inline PR review with:

• A comment on each affected line explaining the issue and how to fix it • A summary table showing Critical / High / Medium counts • A commit status check (pass/fail) visible in the PR checks section

Clean PRs are approved automatically. PRs with Critical or High findings get a REQUEST_CHANGES review.

False positives

Add a // vigil-ignore comment on any line to suppress a finding on the next push.

Privacy

Vigil does not store your code. Diffs are processed in memory and discarded immediately after each scan. No data is shared with third parties or used for training.

Description from the GitHub Marketplace listing.