PUBLICLY BOOKABLE
AI code review for GitHub.
Code Guard checks GitHub repositories for secrets, vulnerable dependencies and repo hygiene. An AI assesses the changes since the last run, and a monthly review checks architecture, security and maintainability.
IN BRIEF
What is Code Guard?
Code Guard is the code review from TOMORIS for GitHub. Two review engines run via a read-only GitHub app: a security scan with established tools and AI assessment of the changes, and a monthly architecture review. Source code is not stored in the process.
- THE TASK
What problem does Code Guard solve?
Credentials in code, dependencies with known vulnerabilities and creeping architecture problems are often noticed late. Manual reviews cannot cover every change, and many tools report “clean” even though they have only seen part of it.
- AVAILABILITY
PUBLICLY BOOKABLE
Code Guard can be booked as a subscription: install the GitHub app, try it free for 14 days, then sign up for Starter, Team or Business directly in the product. At TOMORIS, Code Guard also checks our own repositories.
- THE ROLE OF AIAI
What the AI does
An AI assesses the changes since the last run and checks architecture and security monthly, with redacted secrets and a budget cap. It never changes code and never opens pull requests.
Available
Your next step.
Agreed in concrete terms.
- Install the GitHub app and choose the repositories Code Guard may read
- Receive the first report: secrets across the entire history, dependencies, repo hygiene and AI review of the changes
- After the 14-day trial, choose Starter, Team or Business; above 25 repositories, Enterprise on request
You choose the package and billing in the product; prices are shown below. Code Guard complements human reviews and penetration tests but does not replace them.
FEATURES & MODULES
What the solution
delivers day to day.
- 01
Security scan
Secrets in the code and in the Git history (Gitleaks), dependencies with known vulnerabilities (OSV-Scanner, Dependabot) and repo hygiene such as missing branch protection or red CI.
- 02
AI review of the changes
An AI assesses the changes since the last run; secrets are redacted beforehand. If the AI fails, this appears as a finding and never as “no findings.”
- 03
Monthly architecture review
Two stages with triage and in-depth review: architecture, correctness, security, performance, maintainability, tests and costs. The most important findings first, without style nitpicks.
- 04
Honest coverage
Code Guard measures and shows how much a review has seen. “No high-severity finding” appears only from 90% of the content seen; below that, the result is “unknown.”
IN OPERATION
How Code Guard
fits into everyday work.
- 01
Install the GitHub app
The main app reads contents, metadata, checks and Dependabot alerts. It cannot write.
- 02
Check regularly
The scan runs on weekdays, the architecture review once a month. Clones exist only for the duration of the job in a protected folder and are deleted afterwards.
- 03
Work through findings
Traffic light per repository, new findings highlighted, resolved ones checked off. Findings are stored without source code.
PRICING
Packages and prices.
Clear and net.
All prices are net plus VAT, from the TOMORIS price catalog.
- PACKAGETRIAL
Starter
€49per month
- including 3 repositories
Try free for 14 days
- PACKAGETRIAL
Team
€19per repository per month
- minimum 5 repositories
Try free for 14 days
- PACKAGETRIAL
Business
€390per month
- including 25 repositories
Try free for 14 days
- HOW TO GET STARTED
Try free for 14 days
Install the GitHub app, try it free for 14 days and then choose the package directly in Code Guard. Above 25 repositories: Enterprise on request.
Try free for 14 days
WHO IS IT FOR?
For people who need clarity.
- Companies with in-house software development on GitHub
- Development and platform teams
- Those responsible for a secure software supply chain
RESULT
What Code Guard improves in concrete terms.
- 01See secrets and vulnerable dependencies earlier
- 02A second, objective look at every change
- 03Honest statements instead of false all-clears
ENVIRONMENT & INTEGRATIONS
Close to the process
instead of isolated.
- GitHub (read-only app)
- Gitleaks
- OSV-Scanner and Dependabot
- AI review with a budget cap
SUMMARY
Code Guard at a glance
- What is it?
- Code Guard is the code review from TOMORIS for GitHub. Two review engines run via a read-only GitHub app: a security scan with established tools and AI assessment of the changes, and a monthly architecture review. Source code is not stored in the process.
- Who is it for?
- Companies with in-house software development on GitHub; Development and platform teams; Those responsible for a secure software supply chain.
- What does it deliver?
- See secrets and vulnerable dependencies earlier; A second, objective look at every change; Honest statements instead of false all-clears.
- How is it available?
- PUBLICLY BOOKABLE — Code Guard can be booked as a subscription: install the GitHub app, try it free for 14 days, then sign up for Starter, Team or Business directly in the product. At TOMORIS, Code Guard also checks our own repositories.
CLEAR ANSWERS
Frequently asked
questions.
Can Code Guard change our code?
No. The main app has read-only permissions; a write permission in the app manifest makes the tests fail. Issues are created only by a separate export app that is installed deliberately.
Is our source code stored?
No. Clones exist only for the duration of a job in a dedicated, protected folder and are deleted afterwards. Findings are stored without code. For customer tenants, code goes to a language model only via a path without data retention; if this is not confirmed, nothing is sent and the result is “not measured.”
Does Code Guard replace reviews or penetration tests?
No. No tool can guarantee error-free and absolutely secure code. Code Guard complements human reviews and penetration tests.
Can we book Code Guard today?
Yes. You install the GitHub app, try it free for 14 days and then choose in the product: Starter (up to 3 repositories), Team (per repository, from 5) or Business (up to 25 repositories). For more than 25 repositories, Enterprise is available on request.
YOUR NEXT STEP
Find the right fit
for Code Guard.
We clarify the goal, environment, integrations and the permissible next step.