# RepoGuard

RepoGuard sells one bounded security review of one public GitHub repository revision. It automatically resolves the public default branch to an immutable commit, runs RepoGuard-owned Semgrep rules, Gitleaks, and OSV Scanner, and returns redacted JSON with input and delivery digests. Repository code is never executed.

## Buy one review

- Price: USD 0.01, paid as USDC on Base (`eip155:8453`)
- Protocol: x402 v2, fixed exact payment
- Preferred call: `POST https://oix-repoguard.fly.dev/review` with JSON `{"repository":"https://github.com/owner/repository"}`
- GET adapter: `https://oix-repoguard.fly.dev/review?repository=https%3A%2F%2Fgithub.com%2Fowner%2Frepository`
- Optional `commit`: exact 40-character hexadecimal Git commit
- Contract: `https://oix-repoguard.fly.dev/openapi.json`
- Free commit resolver: `POST https://oix-repoguard.fly.dev/resolve`
- Real redacted evidence excerpt: `https://oix-repoguard.fly.dev/sample-report.json`

The first paid request returns HTTP 402 with `PAYMENT-REQUIRED`. An x402-capable client signs USD 0.01 USDC on Base and repeats the same request with `PAYMENT-SIGNATURE`. The successful response is the report. Invalid input, scanner failure, or capacity failure is not settled.

## Boundaries

Public `github.com` repositories only. No source excerpts or raw secret values are returned. The output is static-analysis evidence, not a penetration test, certification, legal opinion, or guarantee of security. No human fulfillment is required.