A free security desk for every team in this room.
Found.
Fixed.
Proven.
Paste a public GitHub link. Semgrep finds the issues, three agents on Guild sort the real ones from the noise, write a plan, and write the patch. Every patch is applied to our copy and rescanned before you ever see it. Your report is private. The room sees only what you allow.
–projects checked
–real issues confirmed
–false alarms removed
–fixes verified by rescan
–seconds, median found to fixed
Live in the room right now
Projects on the board
- No team has opted in yet.
What AI wrote wrong today
Same bug, many projects
- Waiting for one rule to fire in two projects.
Happening now
What happens to your repo
- CloneA shallow copy of your public repo lands on our machine. We never run it.
- ScanSemgrep's full ruleset reads every file. Vendored and generated code is skipped.
- TriageA Guild agent reads each finding with the code around it and says real or noise, and why, in plain words.
- PlanA second agent groups the real issues by root cause and orders them: leaked secrets first, then anything an outsider can reach.
- FixA third agent writes the smallest safe change for each issue, one at a time.
- VerifyWe apply the change to our copy, check it still parses, and rescan. Only patches that pass get shown.
- ReportYou get a private link: the plan, every issue, every verified diff, and one patch file to apply with
git apply.
Variant hunt
When a rule fires as a real issue in one project, we show every other project in the room where the same rule fired. One bug here leads to the same bug in the next team over.
Room memory
Every verified fix is remembered by rule. The next time that rule shows up anywhere in the room, the fixer gets the proven fix as an example. Guidance, not copy and paste: each patch is still applied and rescanned on its own.
What we promise
- Opt in only. We scan a repo when its team submits it, and nothing else.
- Read only. We never push to your repo, never touch a deployed app.
- We never execute your code. Clone, read, Semgrep, a parse check, nothing more.
- Secrets are masked before they are stored, sent to any model, or shown.
- Your team name appears on the public board only if you tick the box.
- "Verified by rescan" means the scanner no longer flags the code and the file still parses. It does not prove the app behaves the same. Read every diff.
- We delete our copy of your repo when the event ends.