What it does
Bishop checks indie apps for security holes and lawsuit risks. You install the GitHub App and pick a repository in Bishop. Bishop reads your code and git history. It reads each pull request. Rules and parsers look for possible security holes and lawsuit-risk patterns, and they decide most findings. For some possible SQL injection and unescaped HTML, a language model makes the call on a short excerpt of the code. Bishop then comments on the pull request with the file and line for each finding. Each finding gives a plain-language reason and what to check by hand. You decide what to fix. During the beta, findings are unproven candidates. During the beta, Bishop does not open pull requests, merge or push to your repository.
Capabilities
- Reads git history and high-entropy strings to find leaked keys, and always says to rotate them.
- Masks detected keys before anything is posted or sent to the language model.
- Uses a GitHub token limited to one repository for each scan, and does not store the token.
- Flags known lawsuit-risk patterns, such as personal data sent to a third party that your privacy policy does not name. It is not legal advice.
- Bishop says it reached about 86% security precision on OWASP Juice Shop, a 1,300-file codebase it did not write, with 6 of 7 flagged findings real after hand adjudication.
When to use it
- You want a second reader on the pull requests of a repository you pick.
- You want to check whether a committed key is still sitting in git history after push protection.
- You want lawsuit-risk patterns flagged on the pull requests of your indie app.
