Help
FAQ
Short answers to questions agencies and judges ask.
What does Pich check?
Whether an advisory’s stated conditions are present in a Next.js app’s code and configuration, not only whether the version matches.
Does Absent within inspected scope mean the app is safe?
No. It means a required condition was not found in the files Pich inspected.
Does the AI decide the verdict?
No. SERV Reasoning reads the advisory. Deterministic code decides the verdict.
Does Pich run my code?
No. It reads a few files as text. The runtime proof only runs bundled demo apps, locally.
Can it check private repositories?
Not today. Only public GitHub repositories.
Does it cost anything?
The live demo is free to use and needs no account.
Does Pich replace a security review?
No. It tells you which clients need attention first and why.