Skip to main content
QWED Security is a GitHub App that automatically scans your Pull Requests using deterministic verification engines — not another LLM. It uses formal solvers (SymPy, Z3) and AST analysis to mathematically prove that code, math, and logic in your PRs are correct.
Unlike AI code reviewers that “guess,” QWED Security provides deterministic proof. 1+1 always equals 2.

​
How it works

  1. A developer opens or updates a Pull Request
  2. GitHub sends a webhook event to the QWED Security App
  3. The app creates a Check Run (“QWED Security”) on the PR
  4. Files are scanned using QWEDLocal — QWED’s in-process verification engine
  5. Results are posted directly to the Checks tab on the PR

​
What QWED Security catches

​
🛡️ Code security (AST analysis)

Detects dangerous code patterns before they reach production:

​
🧮 Math verification (SymPy)

Validates mathematical formulas and constants — tax rate calculations, interest/NPV formulas, unit conversions, and financial compliance rules.

​
⚖️ Logic validation (Z3 prover)

Ensures boolean logic and business rules are satisfiable — contract clause contradictions, business rule conflicts, and constraint satisfaction.

​
🔒 PII detection

Detects sensitive data before it enters your codebase — credit card numbers, Social Security Numbers, email addresses, and API keys.

​
Installation

  1. Visit QWED Security on GitHub Marketplace
  2. Click Install
  3. Select the repositories you want to protect
  4. Done — QWED Security will automatically scan new Pull Requests
QWED Security is a Verified Publisher on GitHub Marketplace. You can install it directly from the Marketplace listing.

​
Plans

​
Check run output

When QWED Security scans a PR, you’ll see results directly in the Checks tab:

​
✅ All clear

​
❌ Issues found

​
Privacy and security

  • No code storage: Files are analyzed in-memory and discarded
  • Webhook verification: HMAC-SHA256 signature validation
  • JWT authentication: Short-lived JWT tokens (10-minute expiry)
  • Open source engines: All verification logic is Apache 2.0

​
Permissions

​
Configuration

QWED Security works out-of-the-box with zero configuration for Python projects. Install the app and it starts scanning PRs immediately.
  • Languages: Python, Go, Rust, and TypeScript
  • Trigger: Pull Request events (opened, synchronized, reopened)

​
QWED Security app vs GitHub Action

The GitHub App provides automatic, zero-config PR scanning. The GitHub Action provides configurable verification within your CI/CD pipeline. They complement each other.

​
Support