Reviews. Comments.
In every PR.
SecureHup AI joins your repo as a reviewer — drops inline comments on the exact lines that introduce risk, posts a per-PR security summary, and offers one-click "Apply suggestion" patches engineers can merge without leaving the diff view.
Reviews that land in the diff.
Not in a separate dashboard.
A real PR. The bot reviews the diff, posts an inline comment on the offending line, drops a one-click suggestion, and writes the security summary your reviewers actually read.
42 router.get('/orders/:id', requireAuth, async (req, res) => { - const order = await db.orders.findById(req.params.id);+ const order = await db.orders.findOne({ id: req.params.id });44 45 if (!order) return res.sendStatus(404); 46 res.json(order); 47 });
The new lookup still trusts req.params.id without scoping to the caller's tenant. Reproduced as IDOR (CRITICAL) — user tenant-A can read tenant-B's orders by guessing the ID. Replayed against the PR preview at 21:04 UTC.
- const order = await db.orders.findOne({ id: req.params.id });+ const order = await db.orders.findOne({+ id: req.params.id,+ tenantId: req.user.tenantId,+ });
-
IDOR on GET /api/v1/orders/:id — reproduced cross-tenant read. -
Auth middleware unchanged — JWT validation still passes. -
No new dependencies, no secret leakage in the diff.
Animated demo — every comment, suggestion and gate decision comes from agents that re-test the diff on a real preview environment.
A reviewer that already knows your stack.
The bot installs as a GitHub App, reviews every pull request automatically, and writes feedback in the same UI your engineers already use to ship code.
Inline review comments
Comments land on the exact lines that introduce risk — no separate dashboard, no security ticket queue, no triage UI to learn.
Per-PR security summary
A single top-level summary tells reviewers what changed from a security perspective, what was tested, and what still needs a human look.
Apply suggestion, merge, done
Suggested patches use GitHub's native "commit suggestion" UI — accept, push, and the fix is in the branch without ever leaving the diff.
Signal, not noise.
Linters and SAST scanners drown PRs in dozens of "informational" findings. SecureHup AI only comments when something genuinely changes the security posture of your code.
Diff-aware reasoning
Reviews only what the PR changed and the call sites it touches — no comments on legacy code reviewers can't action in this PR anyway.
Verified before it speaks
The bot only blocks a merge after an autonomous agent has actually reproduced the exploit on the PR's preview environment.
Talks to reviewers like a human
Reply to a comment with "false positive" or "explain" and the bot answers in-thread — no JIRA round-trip, no separate triage tool.