Human-reviewed cleanup plans for Python/FastAPI services, supported by static checks across code, GitHub Actions, and Docker.
secrets/, .env, Terraform, auth, and security paths are excluded from automated edits, not from analysis.
The Free hosted plan reports findings on public repositories. The paid audit adds human verification and prioritization; it does not include code changes.
The RepoWave App is public and can be installed on other accounts. Select a public repository for the Free plan. Installation automatically starts an eligible default-branch scan; results appear as a comment on that GitHub commit.
A signed webhook schedules a scan for that commit.
Findings include rule, severity, file, line, and message.
Review each finding before acting. For a prioritized cleanup plan, request the fixed-scope audit.
Static checks identify candidates for review. They can miss issues and produce false positives; the paid audit verifies findings against the repository and records uncertainty.
Dead code, blocking calls in async code, missing HTTP timeouts, logging hygiene, and Pydantic compatibility.
Untyped returns, missing response models, and route handlers that do too much directly.
Unpinned actions, missing permission blocks, and unsafe workflow patterns.
Root containers, missing health checks, and common Dockerfile quality issues.
For small teams inheriting a Python/FastAPI service, an engineer reviews scanner findings and source evidence to produce a scoped cleanup plan.
Include the repository URL, default branch, deadline, and primary concern when you reply so the audit can be scoped quickly.
Ruff and other scanners already cover many of these checks. RepoWave uses Ruff for mechanical import fixes. The audit adds source review, reproducible evidence, and a ranked plan for your service; it does not claim unique detection coverage.
The allow-list lives in core/security/autofix_gate.py. Autofix is disabled for the Free hosted plan. The implementation supports entitled draft PRs using Ruff import sorting and unused-import removal; recurring paid plans are not currently sold. Security, secrets, deployment, migration, CI permissions, Terraform, auth, and .env paths stay advisory.
You can read the entire safety boundary in the docs.
Buyers expect documentation, privacy, support, status, and pricing to be one click away. RepoWave keeps those surfaces explicit.
Repository source is fetched for analysis and deleted after the scan. Finding metadata is retained for 90 days.
Privacy policySupport runs through support@repowave.dev. Security reports use the SECURITY: subject prefix.
Install, scan behavior, autofix boundaries, uninstall, limits, and troubleshooting are documented in one place.
Read docsThe health endpoint is public and returns a minimal readiness response for uptime monitoring.
Health checkThe current GitHub Marketplace listing offers the Free plan. Recurring paid plans are not available for purchase there. For paid, fixed-scope help, request a repository audit below.
For public repositories that want continuous scanning without auto-remediation.
No. RepoWave is not a broad AppSec suite. It provides narrow Python/FastAPI repository checks and a separate human-reviewed audit.
No. The Free hosted plan does not open fix PRs, and the paid audit delivers a report. Recurring paid plans are unavailable. The implementation never self-merges or automatically edits denied paths.
The App is public. Choose an account and a public repository for the Free plan. Installation automatically starts an eligible default-branch scan. You can request an audit without installing the App.