Spectre PR review bot

Add Spectre security scanning to any GitHub repo in 60 seconds.

Setup

Copy spectre-review.yml into your repo's .github/workflows/ directory:

mkdir -p .github/workflows
curl -o .github/workflows/spectre-review.yml \
  https://raw.githubusercontent.com/spectre-dev/spectre/main/packages/pr-bot/spectre-review.yml

That's it. Spectre will now scan every PR for security issues and post inline comments on affected lines.

What it does

• Scans all changed .ts, .js, .tsx, .jsx, .py, .go, .rb files
• Posts inline comments on vulnerable lines with plain-language explanations
• Requests changes on PRs with critical findings (blocks merge)
• Posts a security score summary on every PR
• Passes cleanly with a ✓ badge when no issues are found

Example PR comment

🔴 CRITICAL: SQL injection

User input is interpolated directly into a SQL query. An attacker can
manipulate the query to bypass auth or dump your entire database.

Fix: Use parameterized queries: db.query('SELECT * FROM users WHERE id = $1', [id])
OWASP: A03:2021 Injection
CWE: CWE-89

Suppressing false positives

Add a .spectrerules file to your repo:

# .spectrerules
suppressRules:
  - spectre.jwt-no-expiry  # we handle expiry in middleware

Running locally

npm install -g @spectre-agent/cli
spectre scan --files src/ --format text