Static analysis first
Ruff and Bandit run against bounded, untrusted input in a constrained workspace. A reviewed repository's own tool configuration is never trusted, and its code is never executed.
Security-focused code review for every pull request
CodeYinkx runs deterministic static analysis (Ruff, Bandit) on the files a pull request changes, maps findings onto the exact changed lines, and optionally adds an AI-assisted pass. It comments on the pull request — it never approves, merges or modifies code.
Sign in with GitHub Install the GitHub App Open the dashboard
AI is optional
Bring any OpenAI-compatible endpoint — including a free model. AI is off by default, off for private repositories unless the owner opts in, and a provider failure always degrades to static-only results.
Safe by construction
Webhooks are signature-verified and deduplicated, jobs are durable and retried with backoff, quotas are enforced server-side, and comments are validated against the diff before they are posted.
What it does, precisely
- Reads only metadata, contents and pull requests (read), and writes review comments.
- Never requests contents-write or repository administration permission.
- Marks anything not configured as unconfigured instead of pretending it works.