PRGuard for open source
Maintainers are fielding a new kind of pull request: AI-generated, plausible at a glance, and wrong in ways that only surface after you’ve spent your evening on review.
Some are careless. Some are hostile — diffs carrying hidden instructions aimed at the AI tools reviewing them.
PRGuard is automated open-source code review: every contribution is read against your written standards before it costs you a minute.
Add retries to the HTTP client #318
PRGuard reviewed against CONTRIBUTING.md
No new dependencies without discussion package.json:18
Adds a retry library that no issue or discussion mentions.
Tests accompany behaviour changes src/http.ts:41
Requests now retry on failure, and no test covers it.
One place to manage open-source PRs: screen them, audit them, and — if you choose — gate the ones that don’t meet your standards.
Before any review runs, a dedicated gatekeeper screens the diff for prompt-injection attempts — instructions hidden in code or comments trying to manipulate an AI reviewer.
If a contribution tries it, the attempt is recorded, not obeyed. How the screen works.
Write your contribution standards in plain language: “no new dependencies without discussion”, “error messages must not leak paths”, “tests accompany behaviour changes”.
Every PR from every fork is audited against them, in any language your project ships.
By default PRGuard posts its findings as a review and stays out of the way.
Tighten a repo so a FAIL requests changes, and with the PRGuard check required in branch protection, nothing merges until it’s addressed — same audit, but now it can block the merge.
Every decision lands in an audit trail either way.
Comment onlyThe default · no gate
Full reviewCan block on FAIL
A note on cost. Each audit draws from your plan’s metered credit allowance, and active public repositories can generate significant review volume. Plans start small, top-up credits roll over, and skip markers let you exclude changes that don’t need review. For high-volume repositories, we recommend talking to us about sizing a plan before you connect.
AI usage is part of your subscription, not a bill on the side. Every plan includes a set monthly AI credit allowance, and each audit draws from it — no separate API key to bring, no separate token invoice. And if a busy month needs more, top-up credits are available anytime and roll over.