Guard Score runs inside your own GitHub Actions. On every change it builds a private copy of your backend, attacks it as a stranger and as another logged-in user, proves any leak, and posts a 0–100 score right on your pull request. You never open a terminal, and your code never leaves your infrastructure.
Connect a repository
Paste the GitHub URL or type owner/repo.
Usually main.
This copies the workflow to your clipboard and opens GitHub's file editor with the path already filled in. Then paste and commit — that's it.
What happens when you click
The workflow is copied to your clipboard and GitHub opens a new-file editor in your repo, pre-set to .github/workflows/guardscore.yml.
Paste (⌘V / Ctrl-V) into the editor, then click Commit changes. No terminal, no local setup.
Done. GitHub runs Guard Score on every push and pull request from now on, and posts the score with proof. Add the badge to your README to show it off.
Where does the attack run? Entirely inside your own GitHub Actions runner — GitHub's ephemeral CI, in your repo's context. Your source, schema, and secrets are never sent to Guard Score's servers. It's the same engine as the CLI, just triggered by GitHub instead of your keyboard.
Prefer to do it by hand?
Create a file named .github/workflows/guardscore.yml in your repo and paste this in: