Turn on CodeQL, Dependabot, and Secret Scanning across a handful of repositories and you get exactly what the marketing promised: findings. Lots of them. Each one sitting in its own repository's Security tab, behind its own set of tabs and filters, with no shared notion of who owns this, when is it due, or are we getting better or worse.
That's the gap. GitHub is genuinely world-class at the detection half of application security. The operational half - triage, deadlines, ownership, trend lines, and the evidence trail an auditor asks for - is left as an exercise for the reader. Most teams solve it with a spreadsheet, a recurring calendar reminder, and a security engineer who clicks through fifteen repos every Monday morning.
Yōkai is that missing half. It's a free security operations layer that sits on top of GitHub's scanners and turns raw alerts into a managed workflow.
The actual problem
Whether you're maintaining a handful of side projects or running AppSec for a company, this list will look familiar:
