Case study
repyy
A local, read-only scanner that helps developers inspect unfamiliar repositories before running them.
Role: Creator and developer
The problem
Cloning a take-home assignment or unfamiliar codebase often leads straight to installing dependencies and running scripts. The repository can contain setup hooks and other behavior that deserves a closer look first.
Built with
- Go
- CLI
- Static analysis
- Local HTML reports
The approach
- Keep the scan local and read-only: repyy treats target files as data and does not import, build, test, or execute the project.
- Use static checks, heuristics, and known indicators to surface review signals across source code and repository configuration.
- Provide a self-contained HTML report with findings and source locations, plus rule explanations for additional context.
Product considerations
- A match is a signal for investigation; legitimate code can match and suspicious behavior can go undetected.
- A completed scan with no findings is not a safety certificate, and the tool does not prove runtime behavior.
- Keeping repository contents on the user's machine avoids sending private assignment or work code to a service.