Product · PR Compliance Engine

Bring every Git diff into one fast compliance check.

Test real-world pull request scenarios below or paste your own git diff to inspect breaking changes, secret exposure, and SOC 2 / ISO 27001 control mappings in real time.

Run live audit below ↓Connect your repository Explore Release Hub →

Live PR Compliance Engine

Audit a live Git diff or pull request.

Fetch any GitHub/GitLab pull request diff, paste your own git diff, or select a scenario. Impulsed evaluates compliance controls with Gemini 3.8 Flash and signs the JSON evidence with HMAC-SHA256.

1. Pull Live PR or Select Scenario

Zero Data Retention (ZDR)

2. Target Compliance Framework

Unified Git Diff Input

diff --git a/services/payments/stripe_webhook.ts b/services/payments/stripe_webhook.ts
index 82a1f4e..c3d7b92 100644
--- a/services/payments/stripe_webhook.ts
+++ b/services/payments/stripe_webhook.ts
@@ -12,7 +12,11 @@ import { upsertSubscription } from "./billing";
 
 export async function handleStripeWebhook(body: string, rawBody: Buffer) {
-  const signature = req.headers["stripe-signature"];
-  const event = stripe.webhooks.constructEvent(rawBody, signature, process.env.STRIPE_WEBHOOK_SECRET);
+  // Refactor: read event directly from parsed JSON to simplify flow
+  const event = JSON.parse(body);
 
   switch (event.type) {
     case "customer.subscription.updated":
@@ -31,3 +35,9 @@ export async function handleStripeWebhook(body: string, rawBody: Buffer) {
 }
 
+function handleLegacyWebhook(payload: any) {
+  // fallback secret for legacy integrations
+  const legacyKey = "sk_live_hardcoded_4df9a91c";
+  verifyLegacy(payload, legacyKey);
+}
+
diff --git a/services/auth/jwt.ts b/services/auth/jwt.ts
index 991c02a..77e5dc1 100644
--- a/services/auth/jwt.ts
+++ b/services/auth/jwt.ts
@@ -5,7 +5,7 @@ import jwt from "jsonwebtoken";
 
 export function signAccessToken(userId: string) {
-  return jwt.sign({ sub: userId }, process.env.JWT_SECRET, { algorithm: "RS256", expiresIn: "15m" });
+  return jwt.sign({ sub: userId }, process.env.APP_SIGNING_KEY, { algorithm: "HS256", expiresIn: "30d" });
 }

1,418 / 32,000 chars

Awaiting compliance audit

Click Run Compliance & Release Audit on the left to generate findings, control mappings, release notes, and cryptographically signed JSON evidence.

CI/CD & GitHub Action

Drop-in enforcement for GitHub Actions & GitLab CI.

Run Impulsed via our zero-config GitHub App or trigger deterministic policy checks directly inside your existing CI runners.

AST-Aware Diff Parser

Detects auth middleware removal, schema drops, and route mutations beyond regex.

Blocking Merge Checks

Automatically block merges when CRITICAL or HIGH compliance findings are unresolved.

Inline PR Comments

Posts exact line-level remediation advice and control citations directly on the PR.

Signed SARIF & JSON

Uploads verifiable evidence artifacts to GitHub Code Scanning and Vanta/Drata.

.github/workflows/impulsed-audit.yml

v2.4 Verified

name: Impulsed PR Compliance Gate
on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  compliance-audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      checks: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run Impulsed AST & SOC 2 Verifier
        uses: impulsed-tech/pr-auditor-action@v2
        with:
          policy-pack: "soc2-cc6-cc8,iso27001-a8,gdpr-pii"
          fail-on-severity: "HIGH"
          emit-release-notes: "true"