{
 "schema_version": 1,
 "generated": "2026-10-24",
 "id": "usestrix-strix--block-insecure-pull-requests",
 "repo": "usestrix/strix",
 "repo_url": "https://github.com/usestrix/strix",
 "repo_slug": "usestrix-strix",
 "title": "Block insecure code in pull requests",
 "page_title": "How to block insecure code in pull requests with Strix",
 "summary": "Run a quick Strix scan in GitHub Actions on every pull request to catch vulnerabilities before merge.",
 "who": "A dev team lead who wants a security gate in CI so insecure changes do not reach production.",
 "problem": "Security review often happens too late, after code is merged and deployed.",
 "outcome": "A pull request workflow that runs a headless Strix scan and fails when vulnerabilities are found.",
 "steps": [
  "Save the README's strix-penetration-test YAML as a workflow file in .github/workflows/. (inferred, check the README)",
  "Add STRIX_LLM and LLM_API_KEY as repository secrets in GitHub.",
  "Open a pull request so the workflow runs `strix -n -t ./ --scan-mode quick`.",
  "Check the Actions log for the printed findings; the run exits with a non-zero code when vulnerabilities are found."
 ],
 "agent_prompt": "Add the strix-penetration-test GitHub Actions workflow from the usestrix/strix README to <target-repo>, using the STRIX_LLM and LLM_API_KEY secrets. Open a pull request and report the workflow result. Verify that the workflow step runs `strix -n -t ./ --scan-mode quick` and that a non-zero exit is reported when findings exist.",
 "agents": [
  "any"
 ],
 "difficulty": "Intermediate",
 "time": "45 minutes",
 "basis": "readme",
 "caveat": "The README says quick reviews in pull requests are scoped to changed files, which is why the checkout uses fetch-depth 0.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "python",
 "requirements": [
  "Docker installed and running",
  "An LLM API key from a supported provider, or a ChatGPT Plus/Pro subscription sign-in",
  "The application source directory or a target URL you are authorized to test",
  "A GitHub repository with Actions enabled, if you want the CI workflow"
 ],
 "risk": "dual-use",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "credentials",
   "notice": "The workflow depends on LLM_API_KEY stored as a GitHub secret, so limit who can read or change repository secrets."
  },
  {
   "tag": "remote-script",
   "notice": "The workflow installs Strix with curl piped to bash, so pin or review the installer if your CI policy requires it."
  }
 ],
 "best": false,
 "score": 0.9,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/usestrix-strix/block-insecure-pull-requests/",
 "md": "https://dedupedai.com/use-cases/usestrix-strix/block-insecure-pull-requests/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/usestrix-strix--block-insecure-pull-requests.json",
 "api_version": "v1"
}