Inspiration
New teammates often struggle to understand a large GitHub repo quickly, and security-style checks create noise without good triage. I wanted one place to see the repo clearly and spot risky patterns without drowning in alerts, based on how hard onboarding felt early in my career.
What it does
DebtWatch scans GitHub repos for secrets and vulnerability-shaped patterns, then uses AI to help filter obvious noise. It explains repos with Markdown summaries and optional infographics. Analytics and History help you review past runs. Sign-in is through Auth0; GitHub access uses Token Vault on the server so tokens are not stored casually in the client.
How I built it
Frontend: React, Vite, Auth0 SPA SDK, deployed on Vercel from the frontend folder. Backend: Express and TypeScript on Render from the backend folder, with Octokit for GitHub and Google Gemini for reasoning and image output. One GitHub repo, two deploy targets, environment variables wired for production builds.
Challenges I ran into
Callback URL mismatch until Auth0 entries matched the app’s redirect exactly (including trailing slash rules). CORS until FRONTEND_URL on Render matched the live Vercel origin. “Cannot reach API” in production when VITE_API_URL was missing at build time, so the bundle pointed at localhost. Free Render cold starts also made the first request feel slow or flaky until we understood the behavior.
Accomplishments that I am proud of
End-to-end Token Vault flow for GitHub-backed scans, a clear split between scan and explain, and multimodal explain with text plus generated visuals. Shipping a monorepo cleanly to Vercel and Render with sane env and health checks.
What I learned
How Vite inlines VITE_* at build time, why Auth0 URI lists must match character for character, and how CORS ties the browser, Vercel, and Render together. Reading Token Vault docs before coding saved a lot of rework.
What's next for DebtWatch
Stronger export and sharing of reports, finer control over scan scope and limits, optional CI hooks or PR comments, and continued tuning of false positives and model choice for cost and latency.
Log in or sign up for Devpost to join the conversation.