TriDelPhiManual Setup Studio
Choose the checks for your repository. Review the workflow generated in this browser, then copy it or open it on GitHub to commit. Nothing is installed until you add the file.
Checking unfamiliar code before installing it? Use Cloud Scan Studio or the local audit command. This builder is for ongoing repository checks.
The audit reads files on disk, so your built output has to exist before it looks. Without a build it still catches committed keys and open database rules; it just can't see inside a bundle that was never built.
Only build code you trust. This command installs dependencies and executes your app’s build on GitHub. For unfamiliar code, use the local audit or Cloud Scan Studio first.
The core scan always runs. Levels 1–5 add pinned scanners; levels 6–7 add evidence and trust-lock checks.
Your workflow
Commit this as .github/workflows/tridelphi-app.yml.
Paste owner/repository or its GitHub URL. Opens an editor on main in a new tab; review the branch and file before committing. You can copy without a repository.
Already have a workflow? Add this one step
Add it after checkout. Copy the permissions from the full workflow above too; comments and levels 6–7 need extra write permissions.
Prefer the terminal?
Run pipx install git+https://github.com/girnarholdings/TriDelPhi && tridelphi init --wizard
for the same click-through, plus the optional reply-to-fix bot
(comment tridelphi fix on a PR and it applies verified
fixes).
Want to hide your shipped JavaScript?
That's tridelphi privatize. Obfuscation mutates files and
runs your build, so it's a local command, not a CI step:
tridelphi privatize --smoke-cmd "npm start". It is
not security, refuses if your build ships a secret, and keeps
its result only if your smoke check still passes; otherwise it reverts
to your exact bytes.
Before you run. The core scan reads files on your GitHub runner and uploads only a SARIF report to your own Security tab. Ladder levels can download scanners; dependency/posture levels query the public databases they name. Your source is not uploaded. The exposure audit is a static read: a clean result isn’t a penetration test, and a browser can never keep a secret, so it always says rotate and move it server-side, never “hide it.”