documentation
TriageRook documentation
TriageRook scans a public GitHub repo across eleven independent detectors and returns a prioritized report in under a minute — no CLI, no config, no code execution. These docs exist to show their work: what we ask for, what we keep, and exactly how each check runs. Every number on these pages is read straight from the source.
Start here
Trust & data
Scanning
Reference
Detectors
The eleven independent detectors: what each one finds, how it works, and what it deliberately does not catch.
Detection rules
Every rule TriageRook checks, grouped by detection layer.
Posture score
The 17 repo-posture signals, their weights, the A–F scale, and how unknown signals are handled.
IAM risk scanner
OIDC trust, privilege escalation, and admin-equivalent checks over IAM policy-as-code, with vulnerable vs fixed examples.
SARIF export
Send findings to GitHub Code Scanning.
Changelog
What shipped, by date, derived from merged pull requests.
Source is on GitHub. Found a claim on these pages that doesn't match the code? Open an issue— that is a bug.