I build a small CLI called RepoPulse. You point it at a GitHub repository — or a local folder — and it gives you a health report: a score out of 100, pass/warn/fail checks for things like README quality, license, tests, CI workflows, and sensitive file names, plus recommendations you can act on.
Last week someone pasted an external security review of it into my terminal. Five findings — security and engineering issues. None were loud crashes; all were the kind of mistake that erodes trust in an analysis tool's results.
This is a write-up of the two that changed how I think about building analysis tools — and the fixes, which shipped the same day.
The score that looked complete
The second finding read, roughly:
