Two paths. Paste a public repo and nine weighted checks run off the unauthenticated GitHub API. Or connect through a GitHub App, granting Contents: read-only on repositories you pick individually, and it pulls the entire file tree in one call plus a handful of key files — package.json, tsconfig, a CI workflow, .gitignore, the README — to run twenty-odd checks across docs, testing, automation, hygiene, and structure. Every finding cites the paths it came from; only the written plan is model-generated. Your token is sealed in an httpOnly cookie for an hour and never stored.
Checking connection…
This path is public-only by design — it refuses private repositories even if the server's own token could reach them.
A classic OAuth App has no read-only private scope — reading one private repo means asking for `repo`, which is read AND write on every repository you own. A GitHub App asks for Contents: read-only on repositories you select individually, and its user tokens expire. That is the difference between a request a stranger can reasonably accept and one they shouldn't. Your token is sealed into an httpOnly cookie for an hour and never written to a database; source files are read only to compute the findings shown and are not stored or used for training.
