Back to home

Badger documentation

Badger is an open source security review layer for AI-built web apps. It scans GitHub repositories from the server, builds a static security inventory, runs focused AppSec rules, and uses AI to triage evidence instead of blindly trusting pattern matches.

The project is built for builders who ship with tools like v0, Cursor, Copilot and Claude Code, then need a practical way to catch risky code before it becomes a public pull request or production issue.

Quick start

  1. Paste a public repository URL without logging in.
  2. Connect GitHub only if you want private repositories, account repository selection or PR creation.
  3. Choose Normal or Max mode.
  4. Review the grouped findings and the evidence behind each one.
  5. Generate fixes only when the selected findings are safe to remediate.

How it works

Badger does not execute the scanned repository. The scan pipeline is static:

  1. Fetch the GitHub tree and supported text blobs server-side.
  2. Fingerprint the framework, routes, Server Actions, client components and configs.
  3. Run deterministic rules for secrets, auth, client exposure, AI risks, Supabase and CI posture.
  4. Run OSV dependency checks from manifests and lockfiles.
  5. Apply suppressions for tests, fixtures, examples and scanner detector code.
  6. Use AI review on selected evidence to reduce false positives and explain impact.
  7. Store the report, baseline state and exportable artifacts.

Scan modes

ModeUse it forCredits
NormalDefault review with rules plus targeted AI triage.1
MaxDeeper review with broader context and stricter AI reasoning.2
Generate fixesCreates a remediation text draft for selected findings.1

Security model

  • Repository code is never executed during a scan.
  • Badger does not run npm install, package scripts, tests or builds for scanned repos.
  • Secrets and token-looking values are redacted before reports and AI review.
  • Public pull requests should contain real code fixes, not noisy generated reports.
  • Reports, scan history and generated artifacts are tied to the logged-in account.
  • Private repository data should only be reviewed by AI when that behavior is explicitly enabled.

Configuration

Production deployments should use Supabase for persistence. Public repo scans can run without user login through a server-side Badger GitHub App or read-only server token.

SUPABASE_URL
SUPABASE_SERVICE_ROLE_KEY
BADGER_IDENTITY_SALT
BADGER_REQUIRE_PERSISTENT_STORAGE=true
BADGER_REQUIRE_PERSISTENT_QUOTA=true
BADGER_MONTHLY_SCAN_QUOTA=10
BADGER_GITHUB_SESSION_SECRET
BADGER_GITHUB_APP_ID=
BADGER_GITHUB_APP_INSTALLATION_ID=
BADGER_GITHUB_APP_PRIVATE_KEY=
GITHUB_CLIENT_ID
GITHUB_CLIENT_SECRET
GITHUB_REDIRECT_URI
ANTHROPIC_API_KEY

Limits

  • Only supported text files are scanned.
  • Large repositories are capped to keep scans predictable and affordable.
  • Static analysis can miss runtime-only behavior.
  • AI triage improves prioritization, but final security decisions still require human review.
  • Badger is not a guarantee of security or a replacement for a full audit.

Local development

pnpm install
pnpm run dev

# verify before deploy
pnpm exec tsc --noEmit --incremental false
pnpm run lint
pnpm run build
pnpm run scanner:smoke

Links