Security & public reports
Anyone can open wyro.in/scan/<owner>/<repo> for any public repository, without the maintainers asking for it. That is only fair if maintainers can say no, and if a real hole reaches them privately before it reaches a public page. This page sets out both.
Reporting a real vulnerability: maintainers hear first
Most findings on a report are architecture observations, such as a route that reaches a table without passing a guard. Sometimes a finding is an actual, exploitable hole. When Wyro becomes aware of one in a public repository, whether through its own review or through someone reporting it, this is what happens:
- The repository’s public report, badge and directory entry are withheld. The page says only that a report is being handled privately. It never shows the finding, and it never shows a clean result.
- The maintainers are contacted privately: through GitHub private vulnerability reporting if the repository has it enabled, otherwise through the contact in its
SECURITY.md, otherwise by email to a maintainer. - The report stays withheld for 90 days from that first contact, or until the maintainers say a fix has shipped, whichever comes first. If they need longer, ask and it will be extended.
- Details are never shared with anyone other than the maintainers during that window.
If you found a vulnerability in a project using Wyro’s report, please report it to that project privately, not in a public issue. If you found one in Wyro itself, email dominicpaaul008@gmail.com with “Security” in the subject.
Removing a repository’s report
Maintainers can have their repository’s public report removed, along with its README badge and its entry in the directory of checked projects. After removal, Wyro does not scan the repository on its servers at all, and its page says the report was removed at the maintainers’ request. That page is not a result, clean or otherwise.
- Email dominicpaaul008@gmail.com from an address associated with the repository, or open an issue on the repository itself and send the link. Both let us confirm the request comes from someone with write access.
- Removal is done within 48 hours of the request.
- It is permanent until the maintainers ask for the report back.
What happens to the code Wyro reads
- Public scan pages. The server downloads the repository archive from GitHub, parses it in memory and discards the source. Nothing from the source is written to a database or to disk. The rendered report page is cached for up to six hours, then rebuilt from GitHub. The directory of checked projects stores the repository name, framework, star count and finding counts. It stores no code.
- CLI, git hook and GitHub Action. These run entirely on your machine or your runner. Nothing is uploaded. The only network call is fetching a central policy, and only if you configure a paid Wyro token. The action downloads the checker and verifies its published SHA-256 before running it.
- No model. The check is a deterministic parser plus a set of rules. No code is sent to an AI model, used to train one, or shared with third parties. The only exception is the hosting provider that serves the page.
Who runs Wyro
Wyro is founded and built by Dominic Paul in Bengaluru, India. Company registration is in progress. The terms on the legal page are governed by Indian law. Checking public repositories is free and unmetered, and will stay that way: it uses no model, so it costs almost nothing to run. Paid plans cover private repositories, a central CI policy that a repository cannot weaken, history and the architecture canvas. See Plans & billing.
The checker is free to install and run, including in CI, but it is not open source. Its licence does not allow modification or redistribution. The code it runs is published at wyro.in/wyro-check.js alongside its SHA-256, and the GitHub Action that runs it is public.