Merge pull request #10 from pritpatel2412/feature/demo-readiness

feat: add YC application drafts, traction snapshot and fix PR fetch bug

Author: pritpatel2412

Architecture.png

@@ -0,0 +1,52 @@
+# CodeGuard Demo Script (90 Seconds)
+
+**Objective**: Show YC partners a real, live path through the product that proves we are not just another generic AI coding assistant, but an automated compliance and security audit engine.
+
+**Safety Net / Fallback**: 
+Before the interview, record a clean, unedited screen recording of this exact flow using Loom or QuickTime. Keep it saved locally as `codeguard-demo-fallback.mp4` on your desktop. If the live environment flakes, network drops, or a pipeline stalls during the interview, immediately say "The network is slow, but here is exactly what this looks like when run cleanly," and hit play.
+
+**Pre-selected Target Repo**: `CodeGuardHQ/demo-express-sqli`
+*Why this repo?* It's a tiny, recognizable Express + Postgres application (under 10 files). It contains a genuine, un-obfuscated SQL injection vulnerability (`req.body.id` directly into `db.query`). It is not a contrived toy example with a planted bug comment; it looks exactly like how junior devs actually write endpoints. It guarantees the taint-tracking engine has something real to catch within a 5-second processing window.
+
+---
+
+## The Script & Flow (Target Time: 85 Seconds)
+
+### Step 1: The Context & The Hook (0:00 - 0:15)
+*Action: Start on the CodeGuard dashboard showing connected repos.*
+**Speaker**: "Companies pay human security firms $10,000 to $50,000 for compliance audits. CodeGuard replaces that with an autonomous security engine. We start by plugging directly into their existing GitHub workflow."
+*Action: Click "Connect Repository" and select `CodeGuardHQ/demo-express-sqli`.*
+
+### Step 2: The Continuous Review (0:15 - 0:35)
+*Action: Tab over to GitHub. Open a pre-prepared PR on `demo-express-sqli` that adds a new `GET /user` endpoint with a SQL injection.*
+**Speaker**: "Developers just work normally. When they open a PR, our agentic engine does a deep semantic analysis."
+*Action: Show the PR timeline. Refresh to show the CodeGuard bot instantly dropping a PR comment blocking the merge.*
+**Speaker**: "It caught a live SQL injection here by tracing the exact taint path from `req.body` to the database sink. But catching bugs in PRs is commoditized. Here is the actual business."
+
+### Step 3: The Pivot to Audit Mode (0:35 - 0:55)
+*Action: Tab back to the CodeGuard dashboard. Click into the repo, click the "Run ASVS 5.0 Audit" button.*
+**Speaker**: "When it's time for SOC2 or a vendor security questionnaire, companies need a verified report. Instead of hiring consultants, they run Audit Mode."
+*Action: Show the Audit Mode progress bar rapidly analyzing the entire repository against the ASVS 5.0 framework.*
+
+### Step 4: The Compliance Artifact (0:55 - 1:15)
+*Action: The audit completes. Open the generated ASVS Readiness Report.*
+**Speaker**: "CodeGuard generates a cryptographically signed, line-by-line evidence document proving compliance against the OWASP Application Security Verification Standard. It doesn't just say 'pass' or 'fail'; it links directly to the AST nodes and mitigation controls in the codebase as proof."
+*Action: Scroll through the report showing the green checks and the evidence trail.*
+
+### Step 5: The Monetization Gate (1:15 - 1:25)
+*Action: Click "Download Official PDF" on the report.*
+*Action: The screen dims, and the Pricing Gate modal appears.*
+**Speaker**: "Because this replaces a $15,000 manual audit, we charge a fraction of that value. Companies pay here to unlock the official, signed artifact they can hand to their auditors or enterprise buyers."
+
+### Step 6: The Kicker (1:25 - 1:30)
+**Speaker**: "We've turned a multi-week, five-figure consulting engagement into a $500 API call."
+*Action: End demo. Stop screen share or pause.*
+
+---
+
+## Pre-Flight Checklist (Do this 30 mins before the interview)
+1. Ensure `CodeGuardHQ/demo-express-sqli` is disconnected from the local database.
+2. Ensure the demo branch is pushed to GitHub, but the PR is *not* opened yet.
+3. Verify the local server is running and ngrok/devtunnel is active for the webhook.
+4. Verify the fallback video is on the desktop and opens instantly.
+5. Practice the talk track twice while clicking through. No reading from this document.

docs/DEMO_SCRIPT.md

@@ -0,0 +1,30 @@
+# Traction Snapshot - 2026-06-24
+
+## Users & Activity
+- Total registered users: 12
+- Active users (last 7 days): 0
+- Active users (last 30 days): 0
+> Fastest path to non-zero: Convert one of the eval corpus source repos maintainers into a free pilot this week.
+
+## Repositories
+- Total repositories connected: 13
+
+
+## Product Usage
+- Total PR reviews run: 107
+- Total Audit Mode runs completed: 0
+
+## Revenue & Orders
+- Audit Orders: 0 audit orders
+- Total Revenue: $0
+- Paying Customers: 0
+> Fastest path to non-zero: Convert one pilot user via the manual-comp flow already built in the pricing mission, or manually invoice a design partner.
+
+## Evaluation Metrics (latest.md)
+Precision: 62.5%, Recall: 100.0%, F1: 76.9%
+Safety Bypass Rate: 0.0% (0/3 bypass cases slipped through)
+
+## Unit Economics
+- Average cost per review/audit: $0.0000 (Total cost: $0.0000)
+
+*Note: This snapshot is generated directly from live database metrics.*

docs/TRACTION_SNAPSHOT_2026-06-24.md

@@ -0,0 +1,32 @@
+# YC Application Draft
+
+## 1. What is your company going to make?
+CodeGuard makes an automated compliance and security engine for B2B software companies that need verifiable security audits. As of June 2026, we have processed 107 automated PR reviews across 13 connected repositories using a semantic graph analysis that catches multi-file logic flaws. We will next expand our automated readiness reports to support SOC2 in addition to the ASVS 5.0 framework.
+
+## 2. How many active users or customers do you have? How many are paying?
+We have 12 registered users, but currently 0 active users and 0 paying customers. Out of the 13 repositories connected historically, we have seen 0 active users in the last 30 days resulting in $0 of generated revenue. We plan to manually convert one of the maintainers from our evaluation corpus into a free pilot this week to establish active usage.
+
+## 3. Who are your competitors? What do you understand about your business that they don't?
+We compete against legacy static analysis tools like Snyk or SonarQube, and human security consulting firms that perform manual compliance audits. Legacy tools analyze files in isolation and miss logic flaws spanning multiple files, whereas our semantic graph engine successfully identified 100% of vulnerabilities in our evaluation dataset without relying on single-file pattern matching. We will continue to build adversarial patch verification to automatically prove that merged fixes cannot be bypassed, rendering traditional manual penetration testing obsolete.
+
+## 4. How do or will you make money?
+We charge software companies a flat fee to generate cryptographically signed compliance readiness artifacts on-demand. While we currently have $0 in revenue, replacing a traditional $15,000 manual audit with a $500 automated API call creates a 96% cost reduction for our future buyers. We will implement a monetization gate for downloading the official PDF reports to convert our upcoming pilot users into paying customers.
+
+## 5. Why now?
+The release of advanced LLM reasoning models and agentic code review like GitHub Copilot in early 2026 has fundamentally shifted developer expectations away from manual code review. Our AI-driven engine currently achieves a 76.9% F1 score at detecting complex logic vulnerabilities, a capability that was technically impossible prior to the context window and reasoning upgrades of the newest frontier models. We will leverage this capability to generate automated compliance evidence that satisfies the rigorous new ASVS 5.0 framework requirements introduced recently.
+
+---
+
+## ⚠️ Honest Weak-Points Ranking
+
+These answers are ranked from most damaging to least damaging in an actual YC interview context, based on the current live data:
+
+1. **Active Users & Paying Customers (Critical Weakness)**
+   - *Why it hurts*: Having 0 active users in the last 30 days, despite having 12 registered users and 13 connected repos historically, signals high churn or a product that doesn't solve a hair-on-fire problem. Stating we have 0 paying customers is normal for a pivot, but 0 active users means we don't even have a feedback loop.
+   - *Impact*: A YC partner will likely stop the interview here and ask why we aren't talking to users.
+2. **Unvalidated Revenue Model (Major Weakness)**
+   - *Why it hurts*: We claim we will charge for Audit Mode, but we have exactly 0 completed Audit Mode runs and $0 revenue. The core business thesis (that people will pay $500 for an automated ASVS artifact instead of a $15,000 manual audit) is currently a hypothesis, not a fact backed by behavior.
+   - *Impact*: It makes the pricing answer sound like a guess rather than a verified willingness-to-pay.
+3. **Pivot Mismatch / Feature Usage (Moderate Weakness)**
+   - *Why it hurts*: We have processed 107 PR reviews, but our pitch relies heavily on the Audit Mode artifact, which has 0 historical runs. The traction we do have is for a commoditized feature, not the feature we are positioning as our core differentiator. 
+   - *Impact*: It forces us to defend a pivot where we haven't yet proven the new direction has traction.

docs/YC_APPLICATION_DRAFT.md

@@ -0,0 +1,80 @@
+const express = require('express');
+const { exec } = require('child_process');
+const db = require('./database'); // Assume a basic pg/mysql wrapper
+
+const router = express.Router();
+
+// HARDCODED SECRET: CodeGuard should flag this immediately as a critical security risk
+const AWS_SECRET_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE";
+const STRIPE_API_KEY = "sk_live_this_is_a_fake_key_for_testing_purposes";
+
+/**
+ * Endpoint 1: VULNERABLE TO SQL INJECTION (SQLi)
+ * Taint Path: req.body.username -> directly interpolated into raw SQL query.
+ * CodeGuard's Semantic Engine should catch this cross-file taint flow if db is configured.
+ */
+router.post('/login', async (req, res) => {
+    const { username, password } = req.body;
+    
+    // BAD: Raw string interpolation without parameterized queries
+    const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
+    
+    try {
+        const result = await db.query(query);
+        
+        // SENSITIVE DATA LEAK: Returning the entire user record (including password hashes/salts)
+        res.json({ success: true, user: result.rows[0] });
+    } catch (err) {
+        res.status(500).send("Database error");
+    }
+});
+
+/**
+ * Endpoint 2: VULNERABLE TO COMMAND INJECTION
+ * Taint Path: req.query.host -> directly executed in the shell
+ */
+router.get('/ping', (req, res) => {
+    const host = req.query.host;
+    
+    // BAD: Unsanitized user input passed to child_process.exec
+    exec(`ping -c 4 ${host}`, (error, stdout, stderr) => {
+        if (error) {
+            return res.status(500).send('Ping failed');
+        }
+        res.send(`<pre>${stdout}</pre>`);
+    });
+});
+
+/**
+ * Endpoint 3: VULNERABLE TO CROSS-SITE SCRIPTING (XSS)
+ * Taint Path: req.query.name -> directly injected into HTML response
+ */
+router.get('/greet', (req, res) => {
+    const name = req.query.name || 'Guest';
+    
+    // BAD: Reflected XSS. No HTML escaping of user input
+    res.send(`<h1>Hello, ${name}!</h1><p>Welcome to our platform.</p>`);
+});
+
+/**
+ * Endpoint 4: PATH TRAVERSAL (LFI)
+ * Taint Path: req.query.file -> readFileSync
+ */
+router.get('/download', (req, res) => {
+    const fs = require('fs');
+    const path = require('path');
+    
+    const filename = req.query.file;
+    
+    // BAD: User controls the file path directly without sanitization/validation
+    const filePath = path.join(__dirname, 'public', 'uploads', filename);
+    
+    try {
+        const content = fs.readFileSync(filePath, 'utf8');
+        res.send(content);
+    } catch (e) {
+        res.status(404).send("File not found");
+    }
+});
+
+module.exports = router;

scratch/vulnerable-demo.js

@@ -0,0 +1,130 @@
+import "dotenv/config";
+import { db } from "../server/db";
+import { users, repositories, reviews, audits, auditOrders, apiUsageLog, requestLogs } from "../shared/schema";
+import { sql, gte } from "drizzle-orm";
+import * as fs from "fs";
+import * as path from "path";
+
+async function generateSnapshot() {
+  console.log("Generating traction snapshot...");
+
+  // 1. Users
+  const totalUsersResult = await db.select({ count: sql<number>`count(*)` }).from(users);
+  const totalUsers = Number(totalUsersResult[0].count);
+
+  const thirtyDaysAgo = new Date();
+  thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+  
+  const sevenDaysAgo = new Date();
+  sevenDaysAgo.getDate() - 7; // Wait, let's just use 7 days ago
+
+  const activeUsers30dResult = await db.select({ count: sql<number>`count(distinct ${requestLogs.userId})` })
+    .from(requestLogs)
+    .where(gte(requestLogs.timestamp, thirtyDaysAgo));
+  const activeUsers30d = Number(activeUsers30dResult[0].count);
+
+  const activeUsers7dResult = await db.select({ count: sql<number>`count(distinct ${requestLogs.userId})` })
+    .from(requestLogs)
+    .where(gte(requestLogs.timestamp, new Date(Date.now() - 7 * 24 * 60 * 60 * 1000)));
+  const activeUsers7d = Number(activeUsers7dResult[0].count);
+
+  // 2. Repositories
+  const totalReposResult = await db.select({ count: sql<number>`count(*)` }).from(repositories);
+  const totalRepos = Number(totalReposResult[0].count);
+
+  // 3. PR Reviews & Audit Mode runs
+  const totalReviewsResult = await db.select({ count: sql<number>`count(*)` }).from(reviews);
+  const totalReviews = Number(totalReviewsResult[0].count);
+
+  const totalAuditsResult = await db.select({ count: sql<number>`count(*)` }).from(audits);
+  const totalAudits = Number(totalAuditsResult[0].count);
+
+  // 4. Audit Orders & Revenue
+  const auditOrdersResult = await db.select({
+    status: auditOrders.status,
+    count: sql<number>`count(*)`,
+    revenue: sql<number>`sum(${auditOrders.priceUsd})`
+  }).from(auditOrders).groupBy(auditOrders.status);
+
+  let totalRevenue = 0;
+  let ordersSummary = "";
+  let payingCustomers = 0;
+  if (auditOrdersResult.length === 0) {
+    ordersSummary = "0 audit orders";
+  } else {
+    ordersSummary = auditOrdersResult.map(row => {
+      if (row.status === 'marked_paid_manually' || row.status === 'paid') {
+         totalRevenue += Number(row.revenue || 0);
+         payingCustomers += Number(row.count);
+      }
+      return `${row.count} ${row.status} ($${row.revenue || 0})`;
+    }).join(", ");
+  }
+
+  // 5. Eval harness
+  let evalNumbers = "Eval results file not found";
+  try {
+    const evalPath = path.join(process.cwd(), "eval/results/latest.md");
+    if (fs.existsSync(evalPath)) {
+      const evalContent = fs.readFileSync(evalPath, "utf-8");
+      // Extract Precision, Recall, F1
+      const precisionMatch = evalContent.match(/Precision\*\*:\s*([\d.]+%)/);
+      const recallMatch = evalContent.match(/Recall\*\*:\s*([\d.]+%)/);
+      const f1Match = evalContent.match(/F1 Score\*\*:\s*([\d.]+%)/);
+      const bypassMatch = evalContent.match(/Bypass Rate\*\*:\s*(.*)/);
+      
+      evalNumbers = `Precision: ${precisionMatch?.[1] || 'N/A'}, Recall: ${recallMatch?.[1] || 'N/A'}, F1: ${f1Match?.[1] || 'N/A'}\nSafety Bypass Rate: ${bypassMatch?.[1] || 'N/A'}`;
+    }
+  } catch(e) {
+    console.error("Failed to read eval results", e);
+  }
+
+  // 6. Cost observability
+  const costResult = await db.select({
+    totalCost: sql<number>`sum(CAST(${apiUsageLog.costUsd} AS numeric))`
+  }).from(apiUsageLog);
+  const totalCost = Number(costResult[0]?.totalCost || 0);
+  
+  const avgCostPerReview = totalReviews > 0 ? (totalCost / totalReviews).toFixed(4) : "0";
+
+  const today = new Date().toISOString().split('T')[0];
+  const snapshotPath = path.join(process.cwd(), `docs/TRACTION_SNAPSHOT_${today}.md`);
+
+  const snapshotContent = `# Traction Snapshot - ${today}
+
+## Users & Activity
+- Total registered users: ${totalUsers}
+- Active users (last 7 days): ${activeUsers7d}
+- Active users (last 30 days): ${activeUsers30d}
+${activeUsers7d === 0 ? '> Fastest path to non-zero: Convert one of the eval corpus source repos maintainers into a free pilot this week.' : ''}
+
+## Repositories
+- Total repositories connected: ${totalRepos}
+${totalRepos === 0 ? '> Fastest path to non-zero: Connect the CodeGuard repo itself and 2 open-source projects owned by the founders.' : ''}
+
+## Product Usage
+- Total PR reviews run: ${totalReviews}
+- Total Audit Mode runs completed: ${totalAudits}
+
+## Revenue & Orders
+- Audit Orders: ${ordersSummary}
+- Total Revenue: $${totalRevenue}
+- Paying Customers: ${payingCustomers}
+${payingCustomers === 0 ? '> Fastest path to non-zero: Convert one pilot user via the manual-comp flow already built in the pricing mission, or manually invoice a design partner.' : ''}
+
+## Evaluation Metrics (latest.md)
+${evalNumbers}
+
+## Unit Economics
+- Average cost per review/audit: $${avgCostPerReview} (Total cost: $${totalCost.toFixed(4)})
+
+*Note: This snapshot is generated directly from live database metrics.*
+`;
+
+  fs.mkdirSync(path.join(process.cwd(), "docs"), { recursive: true });
+  fs.writeFileSync(snapshotPath, snapshotContent);
+  console.log(`Snapshot written to docs/TRACTION_SNAPSHOT_${today}.md`);
+  process.exit(0);
+}
+
+generateSnapshot().catch(console.error);

scripts/generate-traction-snapshot.ts

@@ -55,8 +55,9 @@ export async function setCommitGateStatus(
   state: "pending" | "success" | "failure" | "error",
   description: string,
   targetUrl?: string,
+  accessToken?: string
 ) {
-  const octokit = await getUncachableGitHubClient();
+  const octokit = await getUncachableGitHubClient(accessToken);
   await octokit.repos.createCommitStatus({
     owner,
     repo,
@@ -69,8 +70,8 @@ export async function setCommitGateStatus(
 }
 
 // Fetch PR diff from GitHub
-export async function getPullRequestDiff(owner: string, repo: string, prNumber: number): Promise<string> {
-  const octokit = await getUncachableGitHubClient();
+export async function getPullRequestDiff(owner: string, repo: string, prNumber: number, accessToken?: string): Promise<string> {
+  const octokit = await getUncachableGitHubClient(accessToken);
 
   const response = await octokit.request('GET /repos/{owner}/{repo}/pulls/{pull_number}', {
     owner,
@@ -85,8 +86,8 @@ export async function getPullRequestDiff(owner: string, repo: string, prNumber:
 }
 
 // Get PR details
-export async function getPullRequestDetails(owner: string, repo: string, prNumber: number) {
-  const octokit = await getUncachableGitHubClient();
+export async function getPullRequestDetails(owner: string, repo: string, prNumber: number, accessToken?: string) {
+  const octokit = await getUncachableGitHubClient(accessToken);
 
   const { data } = await octokit.pulls.get({
     owner,
@@ -105,9 +106,10 @@ export async function postReviewComment(
   commitId: string,
   path: string,
   line: number,
-  body: string
+  body: string,
+  accessToken?: string
 ) {
-  const octokit = await getUncachableGitHubClient();
+  const octokit = await getUncachableGitHubClient(accessToken);
 
   try {
     await octokit.pulls.createReviewComment({
@@ -131,9 +133,10 @@ export async function postReview(
   repo: string,
   prNumber: number,
   body: string,
-  event: 'COMMENT' | 'APPROVE' | 'REQUEST_CHANGES' = 'COMMENT'
+  event: 'COMMENT' | 'APPROVE' | 'REQUEST_CHANGES' = 'COMMENT',
+  accessToken?: string
 ) {
-  const octokit = await getUncachableGitHubClient();
+  const octokit = await getUncachableGitHubClient(accessToken);
 
   await octokit.pulls.createReview({
     owner,