Always-on · v1.0
GitHub App · SOC2-friendly audit logs

Always-on code review,
with a daily Slack digest.

Mergehound watches every branch and diff on your GitHub pull requests around the clock — running OWASP-aligned security scans, style and complexity checks, and regression comparisons against your team's stable baseline — so bad merges don't reach standup.

  • Free for public repos
  • Inline CI annotations
  • From $19 per repo / month
Watching every branch & diff
24 / 7
Security scans, ASVS-aligned
OWASP
Slack digest every business day
17:00
mergehound · watch · Acme/payments
live
Today's open findings
04:18 UTC
  • Critical
    Hardcoded fallback secret branchsrc/auth/jwt.ts:42
  • Regression
    Tax rounding re-introduced · was fixed in #1842src/checkout/totals.ts:118
  • Merge-blocker
    Backwards-incompatible NOT NULL — merge-blockermigration 0048_user_scopes
  • Style
    21 instance members · complexity 17src/ui/Banner.tsx
  • OK
    Baseline regression check passedsrc/api/health/index.ts
5 findings · 1 merge-blocker→ slack #eng-review at 17:00
  • GitHub
  • Slack
  • OWASP ASVS
  • SOC 2
  • SAML SSO
  • SCIM
  • CI annotations

Three pieces, working together

One pipeline. Three surfaces for eng leads.

Continuous watches, inline annotations on the lines that matter, and a single end-of-day digest your lead will actually read.

Always-on review

Watches every branch and diff on GitHub — hourly polling against your stable baseline.

Inline comments

Posts severity-coded annotations on the lines that carry risk — Critical, Regression, Style.

Daily Slack digest

One message in #eng-review at 17:00 — new findings, regressions, stalled PRs.

Used by teams at…

  • ACME
  • GLOBEX
  • INITECH
  • SOYLENT
  • UMBRELLA

Day-one install

Ship with Mergehound on day one

Install the GitHub App on one repo this afternoon, scope it tight, and your first digest lands in #eng-review tomorrow at 17:00.

What Mergehound actually does

Catch bad merges before standup.

Most code-review agents sit idle until a PR is opened. Mergehound is the opposite — it watches every push, runs continuous checks, and posts inline comments on the lines that actually carry risk.

  • OWASP-aligned security scans

    Inline comments on hardcoded secrets, insecure auth fallbacks, SSRF and SQL injection sinks.

  • Regression comparison vs. your stable baseline

    Diff-checked against a branch you pin once. Regressions re-appearing on HEAD are flagged with the original fixing PR quoted inline.

  • Style + complexity checks

    Configurable thresholds per language. Add your team's own rule packs on Enterprise.

  • CI-annotation merge-blockers

    Mergehound posts annotations in the format your existing CI already acts on — no second pipeline to wire up.

PR #2841 · jwt fallback
Critical
mergehound-botcommented 2h ago

Hardcoded fallback secret branch reachable when NODE_ENV !== "production". OWASP ASVS V2.10. CWE-798.

src/auth/jwt.ts·line 42
src/checkout/totals.ts:118
Regression
116
 const total = subtotal
117
  // rounded to cents
118
  return Math.round(total * 100) / 100
+
  return roundCents(total, currency) // bank-grade

This regression was last fixed in #1842. Mergehound compared HEADagainst the team's stable baseline and flagged the divergence automatically.

How it works

From install to daily digest in four steps.

Mergehound is a GitHub App with read on PRs and write on issues. Source code stays in your repo — nothing is exfiltrated to train a model.

  1. 01

    Install the GitHub App

    One-click install on the org.

    Mergehound requests read on PRs + write on issues. No source code leaves your repo.

  2. 02

    Pin your baseline

    Tag a stable branch once.

    Every diff is compared against it. Regressions are diff-checked, not guessed.

  3. 03

    We watch every PR

    Inline comments on risky lines.

    OWASP security scans, style + complexity checks, and baseline regression checks run on every push.

  4. 04

    Slack digest at 17:00

    Engineering leads stay informed.

    New findings, regressions that reappeared, and PRs that stalled in review — all in one message.

The daily Slack digest

Engineering leads stay informed without forcing a second checklist.

At the end of every business day, Mergehound posts one message to your #eng-review channel: new findings, regressions that reappeared, and PRs that have stalled in review.

  • Quiet hours respected — no digest on weekends or after 22:00.
  • Each item links to the PR, the inline annotation, and the bot's suggested fix.
  • Slack, Teams, or webhook — Enterprise honors your routing.
#eng-review · Acme/payments
Today · 17:00
MergehoundAPP17:00

Daily digest · 4 findings, 1 merge-blocker, 1 stalled PR

Watched 14 PRs across 3 branches since yesterday. Compared every diff against your stable baseline at main@stable.

  1. 01
    MERGE-BLOCKER#2841

    Hardcoded JWT fallback secret reachable in dev

    OWASP ASVS V2.10 · CWE-798. Inline annotation posted · CI annotation active.

  2. 02
    REGRESSION#2844

    Tax rounding re-introduced in checkout/totals.ts

    Originally fixed in #1842 · re-appeared on HEAD. Suggested fix authored by bot.

  3. 03

    5 style findings · 2 complexity warnings

    Banner.tsx crosses the team threshold (cyclomatic 17 · 21 members).

  4. 04
    STALLED#2823

    PR open for 6.5 days · awaiting a second reviewer

    Owner: @mira · last activity: review comment from @ravi, 4d ago.

Quiet hours: 22:00 → 08:00 · digest skippeddigest_on_review · enabled

Pricing

Free for OSS. From $19 per repo per month for teams.

One click on public repositories. For private repos and monorepos at scale, the team and enterprise plans cover the audit-log + SLA surface area you'll need.

Maintainers of public repositories

OSS

Freeforever
  • Unlimited PRs on public repos
  • OWASP security scans
  • Style + complexity checks
  • Daily Slack digest
Install on GitHub
Most teams pick this

Small private teams

Team

$19per repo / month
  • Everything in OSS
  • Baseline regression detection
  • CI annotations your existing CI acts on
  • Slack + Teams digest destinations
  • SOC2-friendly audit log export
Email nightwren-9@polsia.app

Monorepos at scale

Enterprise

Customvolume pricing
  • Everything in Team
  • SAML SSO + SCIM provisioning
  • Custom rule packs and risk thresholds
  • SLA-backed ingestion windows
  • Dedicated review engineer
Email nightwren-9@polsia.app

Security & compliance

Auditable by default.

  • OWASP ASVS-aligned scans
  • Code never leaves your GitHub
  • SAML SSO + SCIM on Enterprise
  • SOC2-friendly audit log export
  • No LLM training on your diffs

Get started

Drop the second checklist. Watch the bar stay green.

Email us to install the GitHub App on your org, scope it to a single repo first, and see tomorrow's digest in your #eng-review channel by 17:00.