Generous review limits.
A sponsored allowance for your repositories, with more available on request.
BattleTest for Open Source
Security reviews for the projects we all depend on.
BattleTest sponsors PR security reviews for selected open-source projects. Get generous review limits, with model usage covered.
For approved repositories. No model API key needed.
Pull request reviewExample review
src/routes/projects/[id]/+server.ts
const projectId = params.id;
− await db.project.delete({ id: projectId });+ await db.project.delete({
+ id: projectId, ownerId: session.user.id
+ });BBattleTestPR security review
HIGHA signed-in user could delete another user’s project
The delete query uses the project ID without checking its owner. Scope the query to the authenticated user before deleting.
Suggested correction
Include ownerId: session.user.id in the query and return a not-found response
when no matching project exists.
Example of a PR security finding.
More room to review.
Less to manage.
Keep your attention on the project. Sponsorship gives approved repositories a generous review allowance and covers the model usage behind those reviews.
Model usage covered.
Use the managed service without supplying a model API key.
Help from our team.
Get help setting up and a direct way to share feedback about findings.
Who should apply
Building something
people rely on?
We’re starting with a small group of actively maintained projects. We look at recent pull requests, maintainer involvement and community adoption. Star counts are one signal.
- A public repository with an open-source license.
- Active pull requests and engaged maintainers.
- A maintainer or representative who can enable reviews.
- Interest in sharing useful feedback about findings.
From application
to your next PR.
We confirm your sponsorship and approved repositories before you get started. Applying doesn’t change your existing free access.
Tell us about your project.
Share the repository URLs and a contact. A little context helps us understand your project.
We review your application.
We confirm the approved repositories, allowance and sponsorship period.
Connect your repositories.
Get setup help and start receiving security reviews on new pull requests.
Entirely optional
A small badge.
A useful introduction.
If the reviews help, you can share the programme with a README badge. It’s optional, and your sponsored access stays the same either way.
The badge identifies use of PR security reviews. It is not a comprehensive security certification.
Badge guide and README MarkdownA few things
you might be wondering.
How is this different from free PR review?
PR review stays free for everyone. Approved sponsorship adds a generous allowance for selected repositories, with model usage covered and setup help.
Can we request more reviews?
Yes. Sponsored maintainers can ask for an extension to their agreed allowance. We review requests within the programme’s budget.
Do we need to add the badge?
No. Badges and testimonials are optional. Sponsorship does not depend on either.
Does this cover every repository in our organization?
Sponsorship applies to the repositories approved in your grant. Additional repositories can be requested.
Can we self-host instead?
Yes. Self-hosting is a separate option in the documentation. Sponsored model usage described here applies to the managed programme.
Does a review guarantee our code is secure?
No review catches every issue. BattleTest helps identify security concerns in proposed changes and supports your existing review process.
Let’s support your
next contribution.
Tell us what you’re building.
Prefer email? Send your repository URL, GitHub profile and relationship to the project to [email protected].
Applications are reviewed individually. We confirm the allowance and approved repositories before sponsorship begins.
Want to explore the reviewer? Browse the PR Review source code on GitHub >.