See a fix

See the evidence your fix leaves behind.

Watch a finding become a fix PR, clear the gate wall, emit signed evidence, and verify closed after merge. This is the evidence chain your own repository gets on day one.

Install GitHub App How it works

Finding to PR

A reachable finding becomes a bounded fix on its own branch — scoped tightly enough for you to read the change in one sitting.

Gate wall

The change passes the manifest-counted gate set and your CI before we show it to you as ready. A failure shows you a failure, never dressed up as green.

Signed and verified

Your evidence is Ed25519-signed and control-mapped. After you merge, a rescan marks the finding verified-closed and the loop returns to Observe.

Fix walkthrough

Open the evidence a fix leaves behind.

A reachable finding becomes a fix PR, clears the gate wall, and emits signed evidence that verifies closed after merge. Read every stage below.

signed artifact

Add rate limiting before credential verification

A reachable throttling finding becomes a bounded fix PR with tests, gate results, signed evidence, and a post-merge verified-closed state — $340K of priced risk cleared.

verified closed

4 files 12 tests 7m 42s CI

@@ app/auth/verify.ts:38
  const body = credentialSchema.parse(await req.json());
- const ok = await password.verify(body.password, account.hash);
+ await limiter.consume(requestIp, LOGIN_POLICY);
+ const ok = await password.verify(body.password, account.hash);
+ await audit.append(evidencePacket(finding.id));
  if (!ok) return reject(401);

$340K ΔEBITDA at risk$0 residual after merge

Evidence attached

control-family mapped; signature: ed25519 91f4e2a0

01Findingreachable
An exploit-gated, reachable finding lands on the pull request, priced by exposure: the credential endpoint verifies passwords before any throttle, and that path is reachable from the public route.
app/auth/verify.ts:41 · reachable · $340K ΔEBITDA at risk
02Fix PRbounded
The fix opens on its own branch, scoped to a single boundary so you can read the whole change in one sitting: throttle first, verify second, evidence appended.
4 files, 12 tests, one boundary
03Gate wallpassed
The change clears the gate wall and your authoritative CI before it is presented as ready. A failure shows as a failure, never dressed up as green.
~125 gates (manifest-counted) · 91 security + 35 QA families
04Signed evidencesigned
An Ed25519-signed, control-mapped evidence packet is attached to the change. The deterministic floor always wins over the model verdict.
ed25519 91f4e2a0 · control-family mapped
05Verified closedverified closed
After merge, a rescan confirms the finding is closed and the loop returns to Observe. Closure is proven by re-observation, not asserted — and the priced risk goes to zero.
rescan 14 minutes after merge · $0 residual

unit suitepass

route smokepass

gate wallpass

post-merge rescanverified

The readout

Every claim on this page is an artifact you can open.

The walkthrough below is the same evidence chain your own merge produces: the priced finding, the bounded diff, the gate wall, the signed packet, the rescan. Status always reads as an icon plus text, never color alone.

The finding, priced in dollars
The diff, bounded and readable
The packet, signed and mapped
The rescan, closure confirmed

Reduced motion

The explorer respects your settings.

The evidence explorer animates by default, but falls back to a static, fully readable view when you set prefers-reduced-motion. You can reach every stage by keyboard.

prefers-reduced-motion honored
Static fallback is complete
Keyboard reachable
Monochrome line-art empty states