Quickstart

Step 1: Install the GitHub App

Go to your PRCheck dashboard and click "Connect GitHub". You will be redirected to GitHub's app installation flow. PRCheck requests three permissions: pull_requests: read, checks: write, and contents: read (scoped to diffs only).

Choose "All repositories" or select specific repos. Solo plan is limited to 2 repos. Team and Business plans have no repo limit.

Step 2: Select repositories

After installing the GitHub App, return to your PRCheck dashboard. Your connected repositories will appear. Toggle each repo on to enable scanning. PRCheck will start scanning new pull requests immediately after you enable a repo.

Step 3: Configure your first ruleset

PRCheck ships with a default ruleset covering common bug patterns and OWASP Top 10 security issues. This ruleset is enabled automatically for all connected repos. No configuration required to get started.

To customize, create a .prccheck/rules.yml file in your repository root:

# PRCheck custom ruleset
version: 2

extends: default   # inherit default ruleset

rules:
  - id: no-console-log
    type: regex
    pattern: "console\\.log\\("
    message: "Remove debug logging before merge"
    severity: warning
    paths:
      - src/**
      - lib/**

  - id: no-hardcoded-urls
    type: regex
    pattern: "https?://localhost"
    message: "Hardcoded localhost URL found"
    severity: error

  - id: await-needs-try-catch
    type: ast
    match: AwaitExpression
    require: TryCatchWrapper
    message: "Unhandled await: wrap in try/catch"
    severity: error

Step 4: Trigger your first scan

Open or push to any pull request in a connected repository. PRCheck will receive the webhook event and begin scanning within a few seconds. A status check will appear on the PR: "PRCheck scanning..." which changes to a summary once complete.

Review comments appear inline on the diff lines where issues were found. Each comment includes the rule that triggered, the severity, and a short explanation of why the pattern is a problem.

Step 5: Read your first PRCheck comment

A PRCheck comment looks like this on your PR:

prcheckhq[bot] commented on line 43

Security [HIGH]: jwt.decode() skips signature
verification. This line accepts any token,
including forged ones.

Use jwt.verify(token, SECRET) to validate
the signature before reading the payload.

Rule: security/jwt-signature-required

Rule authoring reference

PRCheck rules support two type values: regex and ast.

• regex: fast text-pattern matching. Runs against the raw diff lines. Good for simple patterns (console.log, hardcoded strings, TODO comments).
• ast: structural pattern matching. Parses the changed code into an AST and matches against node types and relationships. Catches patterns that regex cannot (e.g., "await not wrapped in try-catch").

Severity levels: error (blocks PR merge if check required), warning (informational, does not block), info (low-priority note).

Team configuration

Team plan customers can configure PRCheck at the organization level from the dashboard. Organization-level rules inherit to all repos and can be overridden per-repo in the repo's .prccheck/rules.yml.

To disable a default rule for a specific repo, add it to the disable list in your repo's rules file:

extends: default
disable:
  - style/max-function-length  # too noisy for this repo

Notification setup

Connect a Slack webhook from your PRCheck dashboard under Settings > Notifications. PRCheck will post a summary to your channel when a scan completes. The summary includes finding count by severity and a link to the PR.

You can filter notifications to only trigger when HIGH severity findings are present, to reduce noise on clean PRs.