Review. Fix. Approve.
Two scenarios, one principle: every code change is reviewed, you fix the findings with ready-made fix prompts – only then comes approval.
Fictional demo data · two example projects
Pick your scenario
Project grade
5.0
all open findings, computed live
7
Open findings
2
Critical open
0
Approved PRs
Checkout & discount codes
feature/checkout · Mia · 2026-10-20
Grade
4.0
Fix critical & high findings first
Findings in this PR (2 open · 0 fixed)
- B-01critical
Shopify access token in the frontend
- Plain words
- The secret Shopify key sits in the code every browser downloads. Strangers could change orders, customer data and products in the store.
- Location
- assets/index-3b9d2e.js · line 1, column 12,884
- Fix prompt
Remove the Shopify admin token from the frontend completely. Store it as a server-side secret and move all Shopify calls into a server function. Regenerate the token in the Shopify admin, because the old one is compromised.
- C-01high
Shopify webhook without signature check
- Plain words
- The store accepts order notifications without checking they really come from Shopify. Strangers could inject fake orders.
- Location
- Server function shopify-webhook · line 14
- Fix prompt
Verify the HMAC signature on every webhook: compute HMAC-SHA256 of the raw body with the webhook secret and compare it to the X-Shopify-Hmac-Sha256 header. Reject requests without a valid signature with 401.
How the workflow works
Review
Every pull request is automatically reviewed against the AP-26 catalogue – from access control to privacy.
Fix
Every finding comes with a plain-language explanation and a ready-made fix prompt for your AI tool. One click marks it as fixed.
Approve
Only when no critical or high findings remain open is the PR approved – with a grade and proof.