Compliance risk inevery pull request
MergeMind analyzes your PR diffs and maps code changes to SOX, SOC 2, and ISO 27001 controls — so audit findings surface before the merge, not after the deployment.
Free tier works without a license key · No signup · Open source on GitHub
Description:
Fixed bugs and stuff
Risk Level HIGH
SOX (ITGC) Access to programs/data
SOC 2 CC6.1 — Logical access
ISO 27001:2022A.8.5 — Secure authentication
Gap MFA not in test suite
Fix Add MFA integration test
Everything your PRwas missing
Runs automatically on every pull request. No dashboards, no logins, no configuration.
Every PR gets a Low / Medium / High risk score based on the actual diff — not just keywords.
Code changes mapped to SOX (ITGC), SOC 2 (TSC 2017) and ISO/IEC 27001:2022 Annex A controls automatically.
Identifies missing controls before the code ships — not during an audit.
Specific, actionable fixes suggested inline in the pull request comment.
Runs entirely in your CI environment — GitHub Actions or GitLab CI. Your PR diff is sent to OpenAI's API to generate the analysis; MergeMind the product has no server and stores no PR code. (This marketing site's own visit analytics are separate and disclosed in the Privacy Policy.)
Add one YAML file to your repo. MergeMind runs on every PR automatically.
What MergeMind actuallyposts on your PR
No mockups — both blocks below are real, unedited output posted as a comment on a pull request. The second one shows what the paid license adds.
↑ Free tier: PR title, summary and risk level. Unedited, from a live run.
Mask License Key in Logs
This pull request introduces a new function, maskKey, which is designed to obfuscate license keys before logging them. The function ensures that only the prefix and the last four characters of the key are logged, thereby enhancing security by preventing the exposure of full license keys in logs. The maskKey function is integrated into the license creation and revocation processes, ensuring that sensitive information is not disclosed in the logs.
Compliance Mapping
SOX (ITGC): access to programs and data
SOC 2 (TSC 2017): CC6.1 logical access controls
ISO/IEC 27001:2022: A.8.5 secure authentication
Control Gap
There may be a lack of comprehensive logging policies that dictate how sensitive information should be handled in logs, which could lead to potential exposure if not managed properly.
Recommendation
Implement a logging policy that defines how sensitive data should be masked or omitted in logs across the application to ensure compliance with security best practices.
↑ Paid license: the same diff, plus control mapping, gap analysis and remediation. This is unedited output from MergeMind analyzing its own commit cb847c1 — a public commit, so you can check the input yourself.
AI-generated and informational — review findings before relying on them (see Terms).
Up and runningin 3 steps
No CLI, no signup, no dashboard. One workflow file and your API key — on GitHub or GitLab.
GitHub: .github/workflows/mergemind.yml · GitLab: copy
examples/gitlab-ci.yml from the repo to .gitlab-ci.yml
Create .github/workflows/mergemind.yml with this complete workflow — copy the whole thing:
name: MergeMind PR Analysis
on:
pull_request:
types: [opened, synchronize, reopened]
permissions:
contents: read
pull-requests: write
jobs:
analyze:
runs-on: ubuntu-latest
steps:
# fetch-depth: 0 so the diff range resolves
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: gusinfosec/mergemind@v1
with:
openai_api_key: ${{ secrets.OPENAI_API_KEY }}
# Optional — omit for the free tier
license_key: ${{ secrets.MERGEMIND_LICENSE_KEY }}
On GitLab, copy examples/gitlab-ci.yml instead and set the same values as CI/CD variables.
Go to Settings → Secrets and variables → Actions → New repository secret. MERGEMIND_LICENSE_KEY is only needed on the paid license.
OPENAI_API_KEY=sk-... MERGEMIND_LICENSE_KEY=mm_live_... # optional — free tier works without it
MergeMind runs automatically and posts compliance analysis as a PR comment. That's it.
Simple, honest pricing
Free tier for solo devs and open source. A one-time license unlocks the full compliance stack.
- ✓ PR title + summary
- ✓ Risk level (Low/Med/High)
- ✓ First 2,000 characters of each diff
- – Compliance mapping
- – Control gap analysis
- – Remediation recommendations
- – Full-diff analysis
Runs on your own OPENAI_API_KEY — OpenAI usage is billed to your account.
- ✓ PR title + summary
- ✓ Full risk level analysis
- ✓ SOX, SOC 2, ISO 27001 mapping
- ✓ Control gap analysis
- ✓ Remediation recommendations
- ✓ Full diff — no free-tier character cap
One-time, per repository. Runs on your own OPENAI_API_KEY — OpenAI usage is billed to your account separately.
One-time license covers a single repo. Multi-repo or team pricing? Email us.
Questions, answered
The things compliance-minded teams ask before installing.
Is my code sent to MergeMind?
No. MergeMind runs entirely inside your own CI environment — your PR diff goes directly from your runner to OpenAI's API. MergeMind's servers never see your code, and the only product data we store is the email + license key used for license delivery. This website is separate: it records anonymous visit events (page, country, referrer, campaign) so we can see whether the site is working — details and opt-out in the Privacy Policy.
What does the free tier include?
PR title + summary and a Low / Medium / High risk assessment, posted automatically as a PR comment. The free tier analyzes the first 2,000 characters of your diff — comfortable for small, focused PRs, and truncated on large ones.
What does the $29 license unlock?
The full diff is analyzed (the free tier's 2,000-character cap is removed), plus SOX (ITGC), SOC 2 (TSC 2017) and ISO/IEC 27001:2022 control mapping, control-gap analysis, and remediation recommendations — all in the same PR comment. Genuinely enormous diffs are still bounded by the model's context window.
How do I get my license key after paying?
It's emailed to the address you use at checkout — usually within a minute. Add it as the MERGEMIND_LICENSE_KEY secret in your repo, and make sure the license_key: line from the install step is in your workflow — that's what passes it to the action. Didn't get it? Email info@cyberglobal.ai.
Does it work with GitLab?
Yes — gitlab.com and self-managed instances (set MERGEMIND_GITLAB_HOST). Analysis is posted as an MR note. Copy examples/gitlab-ci.yml from the repo.
Which AI model does it use?
By default gpt-4o-mini, called with your own OPENAI_API_KEY. Support for OpenAI-compatible self-hosted endpoints is on the roadmap.
What if I need a refund?
Refunds are at our discretion — email info@cyberglobal.ai within 30 days and we'll sort you out.
Does it cost anything beyond the license?
MergeMind calls OpenAI with your API key, so model usage is billed to your own OpenAI account — we charge no per-run or per-seat fee. The default model is gpt-4o-mini; see OpenAI's pricing for current rates.
Is MergeMind open source?
The action code is MIT-licensed and public on GitHub. The compliance mapping, control-gap analysis and remediation recommendations are what the paid license key unlocks.
Will the free tier stay free?
We intend to keep it free, and we never charge you without you buying a license. The Terms let us adjust the free tier if the product changes — if that ever happens we'll say so here.
Are the compliance findings audit-grade?
No — they're AI-generated and informational. They're a fast first pass that shows you what to look at, not a certified audit opinion. Have a human review anything you plan to rely on, as the Terms also state.
Enhance run Function with Diff Override and Improved Error Handling
This pull request introduces modifications to the run function in src/action.js to accept an optional parameter diffOverride, allowing a custom diff instead of the default from getDiff(). Error handling for the OpenAI API response is improved to surface clearer error messages. A new test case validates the functionality.
On the paid plan this same comment also includes SOX / SOC 2 / ISO 27001 control mappings, control-gap analysis, and remediation recommendations — see below.