How it works
VeriFlow’s value chain, walked end to end. The same five stages every pull request goes through — what fires, what runs, what surfaces on the diff, and what the developer sees before merge. No abstractions, no demo call, no abstract architecture diagram.
The five steps
Cycle through the value chain with the step pills below. Each stage shows up live on the PR — no page reload, no scrolling required, same coverage the security team would want.
Step 1
No manual trigger, no webhook you forget to add. The GitHub App posts a single signed ping for every opened PR.
We install once, you forget about us. Every push, every draft, every reopened branch — one PR fires one review. No configurations to maintain, no admin step, no missed runs on a new repo your team added.
What the agent catches
The headline finding categories VeriFlow’s second pass surfaces on the diff. Each one deep-links to the matching band on /security — and to a live, real-world review carrying the finding so the surface is not abstract.
Every review surfaces auth gaps the diff undid — missing token verification, missing ownership checks on resource lookups, and the implicit-trust paths that let a request reach data it should not.
See a live findingThe diff is grepped for credential-looking strings; the call sites they feed into are traced. Patterns include the obvious key-in-config and the subtle base64 blob that decodes to a real key.
See a live findingA second pass that specifically hunts user-controlled input reaching a sink — string concatenation into a SQL query, a shell command, a template renderer, or an LLM prompt — graded by route reachability.
See a live findingEvery manifest change is checked against the advisory catalogues the second pass keeps in mind. A dep added without a pin, a CVE landed mid-week, or a maintainer-handoff signal all reach the review.
See a live findingGet on the early access list
Drop your work email; we’ll send the rollout cadence for each stage of the value chain above. Or start free — a public repo review lands in your inbox before you finish the SAML setup.
Early access
Submissions land in the waitlist tagged source=‘how-it-works’.
Self-serve
Already running reviews? Open the public review gallery for live evidence.
If you want the next layer
Field note → AI PR review for security: shift-left vulnerability detection on every pull request.