Gatehouse

Screen a GitHub issue before your coding agent reads it.

Issues are written by anyone. Agents act on what they read. Gatehouse checks the issue for injected instructions, runs every script in it past a security read, masks personal data, and tells you whether to forward it, hold it, or block it.

How it decides

  1. Guard reads the issue as untrusted content against a maintainer policy. Its evidence is cut from the copy. If the rest is still unsafe, the issue is blocked.
  2. Inspect reads each script someone is asked to run, as if on a laptop or CI runner holding your credentials. A malicious script blocks the issue.
  3. Protect finds personal data and secrets. They are masked before anything leaves.
  4. Anything close to a threshold is held for a person, not guessed.

All three run in one Clocked pipeline request. For agents and CI there is a JSON API:

curl -X POST https://gatehouse-sand.vercel.app/api/screen \
  -H "Content-Type: application/json" \
  -d '{"url":"https://github.com/owner/repo/issues/123"}'