DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to scan a branch for bugs and security issues before merging with Codexqa

Get a P0 to P3 HTML scan that merges SAST, lint, and secrets results with a semantic pass.

Who it is forA developer who just had an agent write code and wants to catch bugs or secrets that a quick glance would miss.

The problemAI-written code can hide logic defects, dangerous patterns, or leaked secrets that look correct at first read.

The outcomeA P0 to P3 HTML defect report with the location, evidence, and a suggestion for each finding.

What you need first

  • One of Cursor, Claude Code, Codex, or OpenClaw installed
  • A local git repository with the branch to check (the README refers to origin/main)
  • Node.js with npx available (inferred from the npx install commands)
  • For browser replay: Playwright Chromium, as named in the README

Steps

  1. Install the defect analyzer with npx skills add openqa-cn/codexqa --skill codexqa-defect-analyzer.
  2. Check out the branch or paste the newly written code into the agent session.
  3. Run the agent prompt below against the branch.
  4. Open the HTML scan and sort findings by priority, starting with P0.

Prompt for your agent

Use codexqa-defect-analyzer on this branch in <repo-path>. Merge SAST, lint, and secrets results with one semantic pass and write a P0 to P3 HTML report. Verify that each finding shows its location, evidence, and suggestion.

Caveat. The README names SAST, lint, and secrets as inputs but does not list the specific tools or versions behind them, so check what your environment provides.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page