DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to check a branch for security risks before merging with Supercov

Scan only what a change introduced for injection, secrets, and unsafe redirects or paths.

Short answer: Export your TypeSafe AI key with export TYPESAFE_API_KEY=; then run npx supercov security to scan the whole repository once for a baseline; run npx supercov security patch to check only what your uncommitted work or branch introduced. All steps.

Credentials. The scan needs a TypeSafe AI API key, so keep it in an environment variable and never paste it into a prompt or a committed file.

Who it is forA developer or reviewer about to merge a branch or uncommitted change that touches request handling or configuration.

The problemA full security scan of a large repo is slow to read, and reviewers need to know what the specific change added.

The outcomeA list of security findings tied to the change, each naming the check that fired and the line where Jev confirms one.

What you need first

  • A project with a complete test command the repository already runs, such as npm test, pytest or cargo test
  • Node.js so npx can fetch Supercov, or one of the other install routes in the README
  • A TypeSafe AI API key from https://typesafe.ai, only for quality and security scoring; coverage needs no account

Steps

  1. Export your TypeSafe AI key with export TYPESAFE_API_KEY=....
  2. Run npx supercov security to scan the whole repository once for a baseline.
  3. Run npx supercov security patch to check only what your uncommitted work or branch introduced.
  4. Run npx supercov quality patch to check the same change for code quality problems.

Prompt for your agent

In the repository at <project path> with TYPESAFE_API_KEY set, run `npx supercov security patch` and then `npx supercov quality patch`. Report each finding with its file and line, and state whether any finding is caused by the current change.

Caveat. The README describes twelve security checks and says findings are not averaged, but it does not claim the scan finds every vulnerability, so treat it as one input to review.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for supercorp-ai/supercov and "Check a branch for security risks before merging"

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer