repyy

Inspect a take-home assignment before installing dependencies, starting the project, or opening its folder in your IDE. repyy provides a local static security review of unfamiliar source repositories. During a normal scan, it reads target files as data and does not intentionally import, build, test, or execute assignment code. Remote scans may invoke host Git, and Docker mode invokes the Docker client and Repyy worker; see Trust and Limitations for those boundaries.

Repyy identifies risks. It cannot prove that a repository is safe.

View the website · View a sample report · Trust and Limitations · Verify releases · Security testing · About the maintainer

Quick start

Install a release from GitHub Releases, or use one of the package-manager commands below:

# macOS
brew install --cask Kevin-Umali/tap/repyy

# Windows PowerShell
scoop bucket add repyy https://github.com/Kevin-Umali/scoop-bucket
scoop install repyy/repyy

# Any platform with Go
go install github.com/Kevin-Umali/repyy/cmd/repyy@latest

Scan a local checkout and save a reviewable report:

repyy version
repyy scan ./unfamiliar-repository --format html --output repyy-report.html

Open repyy-report.html locally. The report is self-contained and makes no network requests while it is displayed; a source link can open the provider website when clicked. Treat reports as sensitive review data.

NO FINDINGS means no enabled rule matched in completed coverage. It does not prove that a repository is safe. Treat SCAN INCOMPLETE as unresolved and review its warnings before relying on the result.

Documentation

Use repyy.dev/docs for the rendered documentation. Inside GitHub, use the Markdown guides:

• Install and run a first scan
• CLI commands and flags
• Trusted configuration
• Docker and manual VM isolation
• Detection coverage and limits
• Trust and limitations
• Release verification
• Security testing

Choose a starting point

• New to repository review: start with Installation, run a local scan, then follow Detection coverage and limits to read the report.
• Comfortable with the command line: use the CLI reference for flags, formats, and repeatable scan workflows.
• Reviewing the security boundary: read Trust and Limitations, then check Release verification and Security testing.

Development and deployment instructions for the Astro site are in site/README.md.

The optional AI agent skill teaches compatible agents to scan before execution and to report incomplete coverage. Install it with:

npx skills add Kevin-Umali/repyy --skill repyy

This optional installer needs Node/npm, Git, and network access. The skill contains instructions; install the repyy CLI separately. See the web skill guide for the full workflow.

Contributing

git clone https://github.com/Kevin-Umali/repyy.git
cd repyy
make check
make security

Read CONTRIBUTING.md before changing detections, output, network behavior, or report compatibility. See SECURITY.md for private vulnerability reports.

License

MIT. Third-party intelligence sources are listed in NOTICE.