GitHub

What it does

A GitHub app that detects malicious code in pull requests and prevents it from getting merged. Alongside it, also released a Semgrep ruleset for detection at any stage of the CI/CD.

Prevent merging of malicious code in pull requests - apiiro/PRevent

A self-hosted GitHub app that listens for pull request events, scans them for malicious code, and comments detections directly on the pull request. Typically, security scans are run by workflow files. However, files can be modified, and when dealing with source modification attacks, should be avoided. A GitHub-app approach addresses this gap, ensuring the scan is not bypassed while providing better flexibility. The app's logic can be leveraged to run any scan. All you need is to add a scanner method to the scan logic . Currently, PRevent detects dynamic code execution and obfuscation, patterns found in nearly 100% of malicious code attacks reported to this day, while being rare in benign…from github.com

• 
  I built a PR listener and ruleset to detect malicious code in CI/CD2025 · github.com · ▲13

  I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…

• 
  PullNotifier2024 · pullnotifier.com · ▲361

  Improve productivity for dev teams using Github and Slack

• 
  AppCanary – Keep vulnerable software off your servers2015 · appcanary.com · ▲108

  aToday, we’re excited to announce that we’re going to be able to build tools that impact almost every software developer on the planet — we’re joining GitHub.

• 
  GitGuardian2018 · gitguardian.com · ▲132

  Detect secrets in source code, public and private!

• 
  I'm Creating a GitHub Repo Quality Bot2018 · github.com · ▲58

  :cop: GitHub Bot For Validating Pull Request Mergability Requirements and Issues Structure - Schachte/Git-Enforcer

• 
  SafeDep Vet2023 · safedep.io · ▲72

  GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!

• 
  /dev/null▲490

  a social network for devs

  Dev tools · 3d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 28d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 26d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 23d ago · openbot.run

• 
  Talanoa▲346

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 21d ago · talanoa.email

• 
  CoreSpeed▲332

  One MCP for everything your agents need: apps, memory, tools

  Dev tools · 29d ago · corespeed.io

• 
  Screen Studio 3.0▲1,832

  Beautiful screen recordings with instant shareable links

  Growth · 2025 · screen.studio

• 
  Tana▲1,665

  Put your notes to work with voice and AI

  AI · 2025 · tana.inc

• IG
  I got laid off from Meta and created a minor hit on Steam▲1,581

  I was at FB/Meta from late 2013 to early 2023, mostly working in the compiler/runtime spaces. I got hit in the spring 2023 layoff wave. I immediately started making games in my newfound free time (a lifelong interest, and I even worked in AA(A?) back ca. ~2000), and in October 2023 I stumbled upon the idea of a roguelike pachinko/plinko game inspired by Luck Be A Landlord. Things snowballed quickly, I started talking to publishers, then worked like crazy through all of 2024, almost the hardest I've ever worked in my career, and launched the game in December 2024. It's sold…

  Work · 2025

• 
  Tanka▲1,410

  AI Messenger with smart reply & long term memory for teams

  AI · 2025 · tanka.ai

• 
  Tool Finder▲1,327

  Your shortcut to better software

  AI · 2025 · toolfinder.com

• 
  I built an app to stop me doomscrolling by touching grass▲1,203

  i wanted to change the habit of reaching for my phone in the morning and doomscrolling away an hour so i built an app to help me. now i have to literally touch grass before accessing my most distracting apps the app is built in swiftui, uses the screen time apis provided by apple and google vision to recognise grass or not i'd love to get your thoughts on the concept.

  Life & fun · 2025 · touchgrass.now