Analysis in context
PentestLouis inspects the selected repository, its dependency manifests and its configuration. Results are grouped with the other available signals so that a code issue and its actual exposure on the web are not handled separately.
- Risky validation and access control practices
- Missing or dangerous security configuration
- Libraries linked to public vulnerabilities
- Keys, tokens and credentials present in the repository
Read-only access and confidentiality
You choose which repositories are accessible when installing the GitHub App. Permissions are shown before you consent and can be revoked from GitHub. PentestLouis does not open pull requests and never writes to the repository.
The report contains sensitive information. It is encrypted and subject to a documented retention period; it should not be shared in a public channel.
A starting point, not an exhaustive human review
Automated analysis speeds up the detection of known families of issues. It does not replace an experienced security engineer’s full understanding of the architecture, the business invariants and past design decisions.