unauthenticated: 60 req/hr · with PAT: 5,000 req/hr. only needs public_repo scope (or no scope for public repos).
token is stored in browser localStorage on this device only.
anthropic api key (for semantic check)
enables README ↔ code semantic match via the anthropic api. uses your own key — calls go directly from your browser to api.anthropic.com.
one call per validation, typically <$0.01 with sonnet, <$0.001 with haiku.
google sheet webhook (apps script)
one-time setup: in your sheet → Extensions → Apps Script → paste the snippet from apps-script.gs → Deploy as Web App → "Execute as: me" + "Anyone with the link" → paste the deployment URL here.
webhook auth token
sent with every log POST. without it the Apps Script rejects the request as unauthorized. rotate by changing both sides if it ever leaks.
— enter a repository —
File a new report.
public repos only · validates source not registry · apply cooldown for new packages