- Context
- Rate-limit guidance for people signed in through OAuth.
- Finding
- Sigma reproduced an error message about an API key that these users did not have.
- Outcome
- The author corrected the wording for each sign-in mode. A final Sigma review reported no verified findings, and the change was merged.
A useful second look
Your engineering
agent.Remembers.
Careful pull request reviews in GitHub.
Sigma checks potential issues and brings
the evidence back to your code.
From our own codebase.
A second look.
A real catch.
An early Sigma review on our Memory MCP Server: a missing ownership check, the author’s fix, and a recheck — all in one public thread.
Follow the review on GitHubAn early review, shortened here.
The linked discussion preserves the report format used at the time.
Sigma Charlie v4
The finding Summary
An issue title isn’t
proof of ownership.
Anyone could open an issue with the expected title. The release workflow could then adopt it as its own tracker.
Read Sigma’s findingThe author’s fixdfd072f
Check who opened it.
issue?.user?.type === "Bot" &&
issue?.user?.login ===
"github-actions[bot]" &&isWaveIssueStart small.
Stay in your flow.
One repository. One pull request.
A useful place to begin.
- 01
Follow your invitation.
Sign in with the GitHub account named in your invitation.
- 02
Choose a repository.
Start with reviews on request. You choose when Sigma takes a look.
- 03
Ask for a review.
Comment
/sigma reviewon a pull request. The result comes back to GitHub.
Try Sigma.
On your project.
Tell us what you’d like to try.
We’ll be in touch when there’s a place.
A request does not grant access automatically.
Already invited?
For your first visit, open your invitation link.