How I turned 27 silent failures into logged ones, closed three real attack surfaces, and pushed test coverage from 62% to 76% while building an automated code-review bot.
A few months ago I set out to build something simple on paper: a GitHub App that reviews pull requests, scans for leaked secrets, applies safe autofixes, and responds to slash commands like a teammate would. I called it GitHub Autopilot. It runs on Flask, uses Redis for job queuing, and talks to GitHub through webhooks.
The first working version took a couple of weeks. Making it safe enough to trust with someone else's repository took much longer - and taught me more about security engineering than any tutorial could.
This article walks through three real vulnerabilities I found and fixed during an internal audit, why each one mattered, and what the process looked like end to end.
Why a Code-Review Bot Is a Security Target
