QWED Security

Deterministic security verification for PRs and release boundaries. Evidence → Context → Policy pipeline emits a Verification Context v1.0 document with proof-bound verdicts. Merge gates open only on ADMIT. Full-codebase visibility, PR-scoped gating — blocks only what the PR introduces, not existing debt. No LLM, no heuristics, fail-closed.

Capabilities

• Verification Context v1.0 — Every scan emits a machine-readable document with verdict (VERIFIED / UNVERIFIABLE / BLOCKED), admission (ADMIT / DENY), and a SHA-256 proof reference binding evidence to the decision.

• Merge Gating — Check run succeeds only when admission is ADMIT. UNVERIFIABLE and BLOCKED fail closed.

• Context-Aware Classification — Distinguishes runtime code, tests, docs, literal strings, and config before deciding.

• Deterministic Policy Engine — Evidence → Context → Policy pipeline. No AI scoring, no probabilistic pass logic.

• AST + Pattern Analysis — Detects dangerous execution primitives, unsafe constructs, and security-sensitive patterns.

• ReleaseBoundaryGuard — Verifies what ships in Python, npm, and Docker artifacts. Blocks secret leakage in release surfaces.

• Secret Detection — Flags credentials, tokens, and high-risk data exposure across code and config.

• VC in PR Comments — Full Verification Context published as a collapsible PR comment for audit.

Benefits

• Reduced False Positives — Separates executable risk from inert code (tests, docs, literals).
• Fail-Closed — Unknown states never pass silently.
• Machine-Readable Evidence — Schema-validated VC contract for downstream tooling.
• Explainable — Every finding includes context classification and policy reasoning.
• Release Surface Coverage — Enforces security on what actually ships.

Getting Started

1. Install the GitHub App
2. Select repositories
3. QWED scans pull requests automatically
4. Review in GitHub Checks:
   • VERIFIED (ADMIT) → merge allowed
   • UNVERIFIABLE (DENY) → review required
   • BLOCKED (DENY) → must fix

Use Cases

• Gate merges on deterministic verification
• Block unsafe execution patterns
• Detect secrets before they land
• Enforce release boundaries for packages/containers
• Feed VC documents into compliance pipelines