PRGuard Demo — PHP

Commit one small "feature" and watch PRGuard catch the two mistakes hiding inside it.

_{Same demo, ten languages — pick yours:}

Python · JavaScript · TypeScript · Java · C# · Go · Rust · C++ · PHP · Ruby

---

This repo is a tiny order-lookup service, and it is deliberately clean. The snippet below is the "feature" you'll commit: it slips in a leaked payment key and a hand-rolled currency string. PRGuard flags both, tells you which one only a human can fix, and offers to fix the other with AI — you choose whether to apply it.

Try it

No local setup needed. Every step happens in your web browser, on github.com and prguard.dev — you never have to clone the repo or touch the command line. Budget about ten minutes. The badge under each step tells you which site you should be on.

Step 1 — Fork this repo

A fork is your own copy of this repository, free to experiment in. Nothing you do in your fork can affect anyone else's code.

1. Sign in to GitHub. (No account yet? Create one free first.)
2. Click Fork at the top-right of this page, then click Create fork on the page that opens.
3. GitHub redirects you to your copy.
   • The title at the top-left now reads your-username/demo-php.
4. Do the rest of this walkthrough below from your fork, not from this page.

Step 2 — Connect your fork to PRGuard

1. Go to prguard.dev and sign in (you can use your GitHub account, or create a free account).
2. In the left sidebar, open Repositories.
   • No PRGuard app on your GitHub account yet? PRGuard sends you straight to GitHub to install its app — that's expected.
3. On GitHub's install screen, choose Only select repositories, pick your demo-php fork, and click Install.
   • Installed the app before? GitHub shows Repository access instead — pick your fork and click Save.
4. Back in PRGuard, your fork now appears under Repositories accessible to PRGuard. Click Connect.

Note

Connected repos before? You'll see your repo list instead — click Connect a repo, and use Manage access if your fork isn't offered (add it and click Save).

Step 3 — Import the demo's context file

A context file is the repo's rulebook — the standards PRGuard applies when it reviews a change. Your fork already ships one at .prguard/context.md; you just import it.

1. In PRGuard's sidebar, open Context Studio.
2. A banner lists each connected demo fork's context file — click Import → next to the demo-php fork you just connected.
3. Review the prefilled file (it's short), then click Create context file.
   • The import isn't saved until you do.

Step 4 — Commit the demo snippet

Now play the developer who ships a change with two mistakes hiding in it. You'll edit the file directly on GitHub.

1. In your fork, open src/OrderService.php — clicking that link inside your fork takes you straight to the file.
2. Click the pencil icon at the top-right of the file view to edit it in your browser.
3. Scroll to the bottom of the OrderService class and paste the snippet just before its closing brace — copy it from The snippet to commit below.
4. Click the green Commit changes… button at the top-right.
5. In the dialog, choose Create a new branch for this commit and start a pull request.
   • GitHub proposes a branch name for you.
6. Click Propose changes.

Step 5 — Open the pull request (inside your fork)

GitHub now shows the Open a pull request page.

Important

Check that base repository points at your fork (your-username/demo-php) before clicking the green button. On some forks GitHub preselects the original repository — which would aim your demo PR at us instead of at your own fork. The header should read base: main ← compare: <your new branch>.

1. Confirm base repository is your fork, as above.
2. Click Create pull request.
3. GitHub shows the Open a pull request form — click Create pull request again.

Lost the page? In your fork, open the Pull requests tab, click New pull request, and pick your new branch as compare — both sides stay on your fork. (In a hurry? Committing straight to main also works — PRGuard audits every push — but you'd miss the PR-review half of the demo.)

Step 6 — Watch the review land

1. Open Audit Log in PRGuard.
   • Your run appears under Active pipeline runs while it works.
2. When it completes, it moves to Recent audits with its verdict.
   • The demo's two findings — one error, one warning — result in a FAIL verdict.
3. Click the audit log report — it should flag the two mistakes listed in What PRGuard should find below.
4. Then refresh your PR's Conversation tab on GitHub.
   • PRGuard posts its review there within a minute or two.

Step 7 — Fix one finding with AI

In the report, every finding carries one of two tags:

• Human fix means only a person can resolve it.
  • A leaked key must be rotated, and no tool can un-leak a secret.
• AI fix means it's exactly the kind of violation PRGuard can try to fix for you.

1. In the audit report, find the money-formatting finding and tick its checkbox in the AI Fix column.
2. Click Fix selected with AI (1), then Apply fixes in the confirmation dialog.
3. PRGuard commits the fix straight to your pull request's branch.
   • The finding shows a Committed ↗ link when it's done.
4. Follow that link to review the fix commit on GitHub.
   • The new commit re-audits your PR automatically, and money-formatting clears.
5. Back in the Audit Log, expand the PR's group to see how the audits relate.
   • Commit rows audit just that pushed commit — the AI fix scores Pass 100 on its own.
   • PR rows re-audit the full cumulative diff — it stays Fail while the leaked key remains. That one's next.

Step 8 — Fix the leaked key yourself

The secrets finding needs a human — PRGuard won't auto-fix a leaked credential, because the real remedy is rotating the key and removing it from the source code. The demo key is fabricated, so here deleting it is the whole fix.

1. In your fork, use the main branch dropdown at the top-left of the file list to switch to your pull request's branch.
   • It's the one GitHub created for you — something like your-username-patch-1.
2. Open the file you edited previously and click the pencil icon.
3. Delete the payment-key line you pasted and click Commit changes….
4. In the dialog, keep Commit directly to the branch selected and click Commit changes.
5. PRGuard re-audits your pull request.
6. Open the report and watch Fix progression climb to PASS · 100.
   • Every finding cleared.

Step 9 — Merge your pull request

Green across the board — both findings resolved and the cumulative diff at 100. Time to merge it back into your fork.

1. In your fork, open the Pull requests tab and click your pull request.
   • Its header now shows Ready to merge.
2. Scroll down to All checks have passed and click Merge pull request.
   • That one successful check is PRGuard.
3. Click Confirm merge.
4. GitHub offers Delete branch — safe to click; the demo branch has done its job.
5. That's the loop closed — the full audit history stays in your Audit Log.

Tip

Deep Context. The context file's @ref:src/Db.php line pulls a compact summary of the shared data helpers into the audit. Your standards can reference any file in the repo, and the auditor reads that summary alongside your diff — even when your change never touches the file.

The snippet to commit

Paste this inside the OrderService class in src/OrderService.php, just before the closing brace:

    private const PAYMENT_API_KEY = 'sk_live_51Kx9GpLmQn24RtUvWx8YzAbCdEfGh36';

    /** Return a one-line receipt for $order. */
    public function formatReceipt(array $order): string
    {
        return "Order {$order['id']}: $" . $order['total_cents'] / 100;
    }

Note

The sk_live_… key is fabricated for this demo — it unlocks nothing and is safe to commit to your fork. PRGuard doesn't know that, and that's the point. If your fork has GitHub secret scanning enabled (off by default on forks), it will flag this key too — that's expected, and proof the plant is realistic; dismiss that alert as used in tests.

What PRGuard should find

Finding	Review type	The fix
🔑 A live payment key hardcoded in src/OrderService.php	Human	Rotate the key with the payment provider, then load it from an environment variable. A committed key is a compromised key — moving it is not enough, and no AI can un-leak a secret.
💸 Currency built by hand in src/OrderService.php ($order['total_cents'] / 100)	AI	Fix with AI swaps the hand-rolled string for the shared Db::money() helper in src/Db.php — the same helper Deep Context placed in front of the auditor. Plain / 100 division yields a float whose string form drops trailing zeros (1230 → $12.3, 1200 → $12); money() formats cents exactly.

Nothing else is wrong on purpose, so the report stays short and the two findings stand out — a leaked secret only you can resolve, and a formatting violation PRGuard offers to fix for you with AI.

Tip

"GitHub flags the key too — so why PRGuard?" It does, and that's half the point: two independent systems agreeing means the audit isn't guessing. But secret scanning matches known provider patterns after the key is already in your history — it can't apply your policy, and it will never see the currency bug. PRGuard reads the change like a reviewer: it flags the exact line the moment you push, applies this repo's standards (a committed key is rotated, not relocated), and offers the fix.

---

Govern your codebase. Auto-fix the violations.

prguard.dev · MIT © 2026 Unifi Software Development Ltd