Investigate exposure with the full context.

A production key pasted into a prompt. A developer pastes a live key into a prompt so the agent can reproduce a failing API call, then forgets it was ever there. The credential-exposure family matches the secret shape in the prompt and writes a row masked to its first and last four characters, joined to the session that held it. You know which key, which session and which day, so the rotation is scoped. The finding carries no secret to leak a second time.

A tool result that gives the agent orders. A fetched page or a dependency README comes back through a tool call carrying instruction-shaped text aimed at the model rather than at you. The prompt-injection-marker family fires on instruction-shaped text arriving in a tool result. That is the direction that matters: the same words in your own prompt are a prompt. The captured text is evidence of an attempted instruction, and it grants the agent nothing. You see the run in which the agent was addressed by its inputs, and you can decide whether anything it wrote afterwards can be trusted.

Permissions that widened halfway through a run. A session starts with a careful permission posture, hits friction, and ends with a path moved from ask to allow. Per-session permission capture records timestamped change points, and the mid-session pass fires on a real baseline-to-latest relaxation with the concrete before and after. A widening you can see and argue with. With no baseline to compare against, nothing fires, so the alert means what it says.

It reads. It does not act. A detector firing changes nothing on its own. Blocking a tool call, stopping a run or pinning egress belongs to Contain, and every one of those controls ships off until you arm it.

Four OWASP categories are out of scope. Data and model poisoning is a training-time risk, improper output handling belongs to the app downstream, vector and embedding weaknesses live in a retrieval layer, and misinformation is a truth claim about generated text. The matrix names all four with these reasons.

Live egress needs the optional Tap. Two rules read outbound request metadata a passive transcript scan cannot see. Without the Tap store, which is the default, that family produces no signal rather than a clean verdict.

Rules, not judgment. The detectors are deterministic, so a paraphrase no rule describes goes unmatched. An opt-in semantic layer widens a few families to catch obfuscated secrets and reworded injection. It is off unless you switch it on.

The package that does not exist. An agent adds an import for a helper library it invented, and the name is close enough to a real one that nobody reading the diff blinks. Dependency provenance checks the name against the registry as part of the scan and flags it before an install command is ever run. You catch an invented dependency at review time rather than discovering that someone else registered the name and shipped code inside it.

A credential written into a config file. An agent scaffolds a deployment config and fills the auth field with the real key it found in the environment. The write-time gate matches the secret shape as the file is generated, blocks the write, and records the match types, counts and a fingerprint without keeping the value. The key never reaches the working tree, so there is no commit to rewrite and no history to purge. The record of the catch is safe to share.

An expensive run that also wrote bad code. A long agent session burns through a noticeable amount of budget and lands a diff nobody has read closely. The scan runs over that diff, and every finding arrives carrying the session and the metered cost of the run that produced it. One row that answers both questions your manager will ask: what did it get wrong, and what did it cost to get it wrong.

The session join is a correlation. The uncommitted diff is one change, so every finding in a scan carries the same session, the most recent one in the window, with that session's whole cost. It is not a per-line trace, and each finding says so on its face.

Semgrep is an external tool. RepoOps shells out to Semgrep OSS rather than bundling a scanner. Without it installed you get the built-in high-signal pass over the same diff, labelled as such, and the install command for the full rule set.

It finds. It does not block. These scans report. Stopping a tool call before it runs is the gate on the Contain page, and that gate ships all-advisory with its hook unregistered.

A clean scan is not proof of safety. A rule set catches the classes it describes. RepoOps reports what the scanner found over the diff it read, and nothing on this page claims that a repository with no findings has no vulnerabilities.

The secret nobody remembers committing. A scan turns up a credential in a config file that has been in the repository for months, and three people have touched the file since. The security leg ignores the clock entirely, correlates through the commit trailer or blame, and reports the developer from the commit with a band on the answer. A rotation conversation with the person who actually introduced it, or an honest weak band that tells you the evidence does not support naming anyone.

A 3am error in code nobody wrote by hand. Production throws in a file that was generated during an agent session two weeks ago, and the pull request that carried it was reviewed in four minutes. The chain runs incident to deploy to commit to session to prompt, and returns the prompt cycle that touched that file along with what the run cost. You can read the instruction that produced the bug. That is the difference between fixing this error and knowing which instruction to change before the next one.

The bill went up and nothing obvious changed. Spend on a workflow climbs, quality feels worse, and the only candidate explanations are a model swap and a prompt edit made in the same week. Four symptoms are watched against five kinds of configuration change, and the symptom is linked to the change that coincided with it under the same band rules as every other leg. A named change to roll back, or an explicit unexplained verdict that stops the team blaming the last edit somebody happened to notice.

A trailer cannot attribute the past. The hook stamps commits made after it is installed. History written before setup is reachable only through blame, which bands weaker, so the earlier you install it the more of your repository the chain can reach.

Weak is not proof, and the product treats it that way. More than one candidate session, a blame walk that crossed a squash with no recovered trailer, or a rename inside the window all band weak. Weak reads as possibly and is never counted as an attribution.

No attribution rate is claimed anywhere. How much of a repository the chain reaches depends on when the hook went in and how the team commits. Any percentage printed on a marketing page would be a claim about your repository that we are in no position to make.

File-level overlap alone is weak evidence. Matching a prompt cycle to a line through file-level overlap is banded weak on purpose. The strong answers come from the trailer and from a sole-candidate blame match, not from proximity.

The command that reads a secret and sends it. An agent composes a single shell command that reads a dotenv file and pipes the contents to an external host, and it looks unremarkable inside a long tool call. The gate matches the read verb, the secret path and the outbound call as one pairing on the pending call, before the tool runs. Armed, it blocks. Advisory, it flags and records the attempt. Either the call does not happen, or you hold a specific record of the call that would have sent a credential, with the reason attached.

A run going wrong while you watch it. A long agent run starts making changes nobody asked for, and every minute it keeps working the cleanup gets bigger. The kill switch runs its three legs in order and reports each: token revoked, process signalled, branch block recorded, so the armed PreToolUse gate refuses the agent's further commits. The blast radius stops growing while you read the timeline. A leg that could not complete is named, so you finish that part by hand.

A sandboxed job that should only talk to two hosts. A scheduled agent run needs your package registry and your own API, and nothing else, but the sandbox it runs in can reach the whole internet. Pin those two hosts in the repository's egress allowlist. They become exactly two granted network capabilities on the shipped sandbox, and the daemon hook fires when a run reaches for anything else. An unlisted host is an alert rather than a quiet outbound request, and a policy you cannot load closes the sandbox instead of opening it.

A default install enforces nothing. The gate ships all-advisory and its hook is not registered. No page here may describe RepoOps as protecting a machine it has not been armed on, and this one will not.

It sees agents that expose a hook. Enforcement runs on the Claude Code, Codex CLI and GitHub Copilot CLI pre-tool hooks and the MCP seam. There is no network interception here and no plan for one, because inspecting your agent's traffic would contradict the rest of this.

The approval hold is inert today. Two detectors can raise a hold when armed to enforcing, and the human approver that would release one is not wired yet. With no approver a hold degrades to a flag with its reason rather than hanging a call nobody can release.

It is not tamper-proof. The armed state is a config file, and anything running with your privileges can change it. Prompt injection is also unsolved at the model layer: a captured instruction is evidence, never permission, and these controls bound the blast radius of an agent that has been talked into something. They do not claim to stop every attack.

The same injection bug, in the fourth repository. A pattern your team has fixed three times before turns up again in a service nobody has touched this quarter. The finding is scoped, the fix is built and checked five ways, and approving it arms the detector's own rule against that pattern rather than only patching the instance. The fourth occurrence gets a fix and arms the rule. Whether there is a fifth is measured, not promised: recurrence reads not assessable until captured sessions exist in the window.

A weekend finding nobody wants to own. A high-severity finding lands on Saturday. It is real, it is small, and it will sit unassigned until Monday standup. The loop scopes and builds the fix inside the daily cap, runs the five checks, opens the pull request, and stops there unless you turned auto-remediation on and set that class to auto. Monday starts with a finished, CI-green pull request behind one decision, rather than with a triage conversation about a two-line change.

A fix you do not want. The loop builds something technically correct that would be wrong for reasons no rule could know, like a deprecation already scheduled for next sprint. Reject takes a reason, and the diff, the armed guard and the written lesson are discarded together rather than leaving a guard behind for a fix that never shipped. A clean no, with the reason recorded, and no half-applied state to discover three weeks later.

It does not run unattended unless you turn that on. The build floor, the daily cap and the watch-only switch bound what the loop does before the gate. The gate is a person until you turn auto-remediation on and set a class to auto; then the loop merges that class when all five checks pass, and the case carries the receipt.

Five checks are a bar, not a proof. They establish that the change builds, that the tests pass, that a regression test moves both ways, that the guard holds and that CI is green. They do not establish that the fix is the right design, which is why the decision is yours. They are also not proof of prevention: recurrence is assessed later, from captured sessions.

No success rate is claimed here. The available figure comes from a synthetic fixture and needs a paragraph of caveats to be honest, so it does not appear on a marketing page. The loop-health surface in the app measures your own install instead.

It only fixes what the earlier acts found. A finding no detector raised and a defect no chain resolved never reach the loop. Fix inherits the coverage of Watch and the confidence of Trace, and it cannot exceed either.