PolicyLint

PolicyLint is a web app + GitHub/GitLab app that enforces secure-coding rules as code, not as a PDF nobody reads. Security teams define lightweight policies (e.g., “no dynamic SQL without parameterization,” “no hardcoded secrets,” “cryptography must use approved libraries,” “PII must be masked in logs”) using a simple YAML DSL and a library of templates mapped to OWASP ASVS and common compliance needs. Developers get fast, actionable feedback directly in pull requests with concrete examples, safe alternatives, and links to internal standards. It also generates an audit-ready trail: which repos are covered, which rules are enforced, exceptions granted, and time-to-fix trends. This is not a full SAST replacement; it’s a guardrail layer that reduces review burden and makes secure coding consistent across teams. Expect some false positives early, but policies are tunable and scoped per repo/service.