{
 "schema_version": 1,
 "generated": "2026-10-26",
 "id": "supercorp-ai-supercov--check-branch-for-security-risks",
 "repo": "supercorp-ai/supercov",
 "repo_url": "https://github.com/supercorp-ai/supercov",
 "repo_slug": "supercorp-ai-supercov",
 "title": "Check a branch for security risks before merging",
 "page_title": "How to check a branch for security risks before merging with Supercov",
 "summary": "Scan only what a change introduced for injection, secrets, and unsafe redirects or paths.",
 "who": "A developer or reviewer about to merge a branch or uncommitted change that touches request handling or configuration.",
 "problem": "A full security scan of a large repo is slow to read, and reviewers need to know what the specific change added.",
 "outcome": "A list of security findings tied to the change, each naming the check that fired and the line where Jev confirms one.",
 "steps": [
  "Export your TypeSafe AI key with `export TYPESAFE_API_KEY=...`.",
  "Run `npx supercov security` to scan the whole repository once for a baseline.",
  "Run `npx supercov security patch` to check only what your uncommitted work or branch introduced.",
  "Run `npx supercov quality patch` to check the same change for code quality problems."
 ],
 "agent_prompt": "In the repository at <project path> with TYPESAFE_API_KEY set, run `npx supercov security patch` and then `npx supercov quality patch`. Report each finding with its file and line, and state whether any finding is caused by the current change.",
 "agents": [
  "claude-code",
  "codex",
  "cursor",
  "gemini-cli"
 ],
 "difficulty": "Intermediate",
 "time": "30 minutes",
 "basis": "readme",
 "caveat": "The README describes twelve security checks and says findings are not averaged, but it does not claim the scan finds every vulnerability, so treat it as one input to review.",
 "category": "Software and DevOps",
 "tags": [
  "Software and DevOps"
 ],
 "lang": "rust",
 "requirements": [
  "A project with a complete test command the repository already runs, such as npm test, pytest or cargo test",
  "Node.js so npx can fetch Supercov, or one of the other install routes in the README",
  "A TypeSafe AI API key from https://typesafe.ai, only for quality and security scoring; coverage needs no account"
 ],
 "risk": "none",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "credentials",
   "notice": "The scan needs a TypeSafe AI API key, so keep it in an environment variable and never paste it into a prompt or a committed file."
  }
 ],
 "best": false,
 "score": 0.8,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/supercorp-ai-supercov/check-branch-for-security-risks/",
 "md": "https://dedupedai.com/use-cases/supercorp-ai-supercov/check-branch-for-security-risks/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/supercorp-ai-supercov--check-branch-for-security-risks.json",
 "api_version": "v1"
}