Ponytail-sec reviews the code you just wrote

Field notes

Companion reads an uncommitted diff, branch commits, or named files; the page says it does not inspect the whole repository in that mode. Its displayed sample is a trimmed run on a Go controller, with findings for an unused function, an insecure TLS setting, and shell-command construction from a query parameter. The audit path is described as whole-repository review, while triage is presented as evidence-based rechecking of individual findings.