v2::active//ContribLens•Security findings → beginner pull requests

Security findings → beginner pull requests.

Paste any public GitHub repo. Get verified findings, a plain-English explanation, and a beginner-ready PR plan with tests, acceptance criteria, and the skills you'll learn — exportable as a maintainer-reviewable issue draft.

Scan a repo → get a PR plan Get started free

Code verifies•AI explains•Human approves

Zero code execution

Secrets redacted in-memory

OSV.dev verified

Evidence hashed (SHA-256)

The Journey

From verified issue to confident contribution.

Four disciplined stages designed to turn raw security findings into actionable learning tasks.

Live pipeline preview

Inspect the live ContribLens pipeline

HIGH SEVERITY · DETERMINISTIC RULESHA-256: 7d4a...b912 (Verified)

GH-ACTIONS-UNPINNED: Action not pinned to full commit SHA

File: .github/workflows/deploy.yml:24 uses mutable tag actions/checkout@v4 instead of a full 40-character commit SHA.

uses: actions/checkout@v4 # Should be pinned to SHA

Ready to generate real pull request plans for your own repositories?

Try it live → Sign up

Core Capabilities

Engineered for precision and contributor growth.

Built to bridge the gap between technical security audits and safe open-source pull requests.

Evidence-First Verification

Every finding captures the exact file, 1-based line range, and code snippet with a SHA-256 cryptographic evidence hash. Zero vague warnings.

Beginner-Ready PR Plans

Actionable tasks with difficulty rating, estimated completion time, suggested changes, test plans, and acceptance criteria.

Skills Gap & Free Resources

Learn what the fix requires before writing code. Curated free learning links from MDN, freeCodeCamp, official docs, and YouTube.

OSV.dev Advisory Cross-Check

Real CVE and GHSA advisories cross-referenced via Google's OSV.dev batch API. AI never invents or hallucinates vulnerability IDs.

Maintainer-Safe Issue Drafts

Structured 8-section Markdown drafts formatted to open-source norms. Zero automated bot spam; human review is required before publishing.

Keyless Deterministic Fallback

The full scanning and explanation pipeline works with zero API keys and no signup. Judges and contributors reach value in under 2 minutes.

Code verifies. AI explains. Human approves.

ContribLens is an assistive tool for open-source contributors, not an autonomous authority. Secrets are masked in memory before leaving your machine, and public issue generation is automatically blocked for credential leaks and critical vulnerabilities (Disclosure Guard).

Read our full Security Model & Disclosure Policy →

FAQ

Frequently Asked Questions

ContribLens uses a deterministic security scanner that owns finding existence, severity, and confidence. Code verifies first. The server-only AI adapter (Gemma 4 31B with Gemini fallback) is strictly grounded: it only explains verified, in-memory redacted evidence with SHA-256 hashes. If no API key is provided, the deterministic rule engine provides full explanations without calling external AI.

Find your first contribution in 2 minutes.

Scan any public repository, get a verified PR plan with tests and learning links, and make a meaningful contribution today.