Nothing runs until you ask, so there is no drive-by comment on every commit. One verdict, comments on the exact changed lines, and a merge gate only if you want one.
Reviews are explicit by design. Four ways to ask, and nothing happens until you do.
Drop the shipguarde label on a pull request and a review starts.
@shipguarde run, or scope it: @shipguarde review src/api.
Hit Re-run on the ShipGuarde check to review the latest commit.
Call the GitHub Action or API with an sg_pat_… key and gate the job on the verdict.
Code review focuses on what your diff introduces, validated in two passes to keep the noise down.
Correctness, security and contract defects introduced by the change, with a concrete trigger named for each.
New linter issues the diff introduces. Pre-existing noise is ignored.
Leaked secrets (API keys, tokens, private keys) on the lines the pull request adds, found by gitleaks.
High and critical npm advisories and blocked licenses, read from your package-lock.json.
OpenAPI and GraphQL surface changes flagged for explicit review.
Risky SQL and Prisma migrations: drops, non-concurrent indexes, unbounded writes.
Changes that push the shipped bundle past the size you agreed to.
ShipGuarde reads replies to its own comments and acts on them, with no dashboard round-trip.
tell it once. it remembers next time.
Reply “false positive” or “intentional” and it suppresses the finding, and remembers it on future runs.
@shipguarde ignore src/legacy stops findings under a path. ignore all mutes the project.
Collaborators can leave durable project learnings it applies going forward.
Every run ends in a single verdict, with inline comments anchored to the exact changed lines.
A GitHub check carrying the verdict and a severity breakdown.
Anchored to real diff lines. Off-diff findings go to the summary, never a random line.
A new one on every review, the last one collapsed as outdated. Severity counts, scope, and what is “fixed since last review”.
Not your tests, build, or install. We never install your dependencies or run your package scripts. The linter does load your repo’s lint config, so it runs in a separate, secret-starved service. With our GitHub App, that service gets a short-lived token scoped to the one repo and read-only. The GitHub App key and other tenants’ data never enter it.
The linter, which loads your repo’s config, runs in a separate service that holds none of the platform’s keys.
With our GitHub App, clones use a short-lived token scoped to the one repo, read-only. Never the App key.
We never install your dependencies or run your tests, build, or package scripts. No postinstall.
Every model call is restricted, in code, to zero-retention endpoints that do not train on what we send.
Install the app, drop the label, and the first verdict lands in about a minute.
Code review checks the diff. ShipGuarde also checks the running product, so a release does not ship on the hope that nothing broke.
NO CREDIT CARD · CONNECT GITHUB IN UNDER FIVE MINUTES · CANCEL ANY TIME
RELEASE CLEARANCE BUREAU
ISSUING AUTHORITY FOR SOFTWARE RELEASES
[email protected]