autter / who it's for

For the people who own what ships.

Not for developers who want faster approvals. For the people accountable when something in production breaks.

“The person who installs autter is rarely the person writing the code. They are the person responsible for what happens when that code reaches production. Every feature decision at autter is evaluated through the lens of the person paying the invoice.”

Engineering Lead / CTO

The Engineering Lead or CTO

You own everything the team ships. Half of it was generated by a tool you did not choose, reviewed by a team under deadline pressure, and approved before anyone truly understood the blast radius.

—40 open PRs. No reliable signal on which three need real attention and which 37 are safe to clear.

—AI-generated code is flooding the review queue. None of your existing tools were built to evaluate it.

—The postmortem is always the first time you hear about the vulnerability.

// autter / PR #247 — api/users/search.ts

risk_level        CRITICAL
blast_radius      14 files affected
finding           SQL injection — unsanitised input reaches query
contributor_risk  MEDIUM (2 recent CVEs from this author)

action            MERGE BLOCKED

Every PR gets a risk verdict before any human opens the diff. Low risk clears. Critical blocks the merge button.

Risk accumulation is visible across all repositories in real time. Not a feeling. Numbers.

Open Source Maintainer

The Open Source Maintainer

Hundreds of contributors you have never met, many of them pointing AI tools at your repository. More PRs arriving each week than you can review thoroughly. No dedicated reviewers. No budget to hire them.

—The majority of incoming PRs are AI-generated boilerplate. They consume hours of review time you do not have.

—A contributor submitted a PR with a vulnerable dependency. It merged. A security researcher filed a report six months later.

—No way to distinguish which contributors are consistently reliable from those generating noise. Every PR gets the same manual attention by default.

// autter / PR #1,203 — lib/auth/session.ts

ai_slop           DETECTED — hallucinated import, non-existent package
contributor       4 of last 5 PRs flagged for quality issues
dependency        CVE-2024-3094 (severity: CRITICAL)

action            MERGE BLOCKED — maintainer notified

AI-generated PRs are flagged and categorised before they reach your review queue.

Contributor intelligence builds a quality profile over time. You know exactly whose PRs need scrutiny and whose can clear automatically.

DevSecOps / Security

The Security or DevSecOps Engineer

Responsible for the security posture of engineering output across the entire organisation. Currently finding vulnerabilities after deployment, in code that is already live. Looking to move security left to the PR stage without requiring developers to change how they work.

—Security scanning happens post-deployment. By then the vulnerability is in production and the remediation cost is 10x.

—Producing SOC 2 and ISO 27001 audit evidence is manual, slow, and assembled from three different systems.

—Developers do not run security tools on their own. Adoption is near zero without enforcement at the gate.

// autter / PR #89 — app/controllers/payments.rb

taint_analysis    VULNERABLE
finding           Unsanitised user input reaches database query
owasp             A03:2021 — Injection
audit_log         Recorded. Exportable PDF available.

action            MERGE BLOCKED

Security checks run automatically on every PR. Zero developer workflow change required.

Per-PR security reports generated automatically, formatted for SOC 2, ISO 27001, and enterprise procurement reviews.

Startup CTO

The Startup CTO Shipping at Speed

Small team. Every AI tool available. Shipping features at maximum speed. You understand the team is accumulating some risk but cannot afford to slow down for thorough manual review on every change. You need a safety net that catches the genuinely dangerous issues without adding friction to what is working.

—The team is using Cursor, Claude Code, and Lovable simultaneously. No clear picture of what the combined output looks like from a safety standpoint.

—Review is a bottleneck nobody wants to slow down. Skipping it entirely is a known risk. You are stuck between both.

—You will not know there is a problem until a customer finds it.

// autter / PR #34 — src/api/checkout.ts

blast_radius      MEDIUM — 6 files affected
ai_slop           CLEAN
security          PASS — no vulnerabilities detected
behavior          PASS — no regressions

action            MERGE APPROVED  ✓

Analysis completes in under 10 seconds on changed files. No friction. Developers do not route around it.

Catches the dangerous three. Clears the safe 37. You stop betting and start knowing.

autter is not for

Developers looking for a personal productivity tool. Teams whose primary pain is style enforcement or formatting inconsistency. Tools exist for all of that.

autter blocks merges. It was built for the person who has to answer for what got through, not the person who submitted it.

Your harbour, your rules.

Installs as a GitHub App in under two minutes. No credit card required.

Install on GitHub →