Dependency advisory triage
For each advisory, whether this codebase reaches the vulnerable path — the difference between a real list and a noisy one.
For the team
Answer from the code, not the document.
The questionnaire asks what the code does with personal data, and the answer comes from a document describing what somebody believed it did a year ago. Now you can ask the code itself and cite the commit the answer was read from.
For security and compliance
The wait today
The questions are not the hard part; answering one properly means reading the code, and the person who signs the questionnaire is rarely the person who can. So the advisory queue stays long, because working out which entries touch a path this codebase ever executes is a week nobody has.
They ask
Ask in your own words. The answer names its commit.
Mention @PRCHD with the question you’d have saved for a colleague, and it reaches the agent exactly as typed. The agent reads the project’s checkout in Act mode, which changes nothing on disk, and the answer lands in the thread footed with the commit it was read from.
- @PRCHD where do we log request bodies, and could any of those contain a token?
- @PRCHD which endpoints skip the auth middleware?
- @PRCHD what personal data does the signup path touch, and where does it go?
- @PRCHD which of this week’s advisories reach code we actually call?
They run
The jobs that keep coming back, written down once.
Each is a prompt plus a posture that someone on the team writes once. After that, anyone in a private channel the operator enabled for runs starts it with one slash command, and the result comes back in the thread. These are examples for security and compliance, not a catalog to install — PRCHD supplies the engine, and each team writes its own.
Secret-handling audit
Where credentials enter, how they are stored, and what reaches a log.
Data-flow map
What personal data the code touches and where it goes, in the shape a DPIA or a customer questionnaire asks for.
Scheduled and triggered
Some of the work is done before anyone asks.
Put the same recipe on a cron line or behind a webhook URL and it starts on its own, so work that used to wait for someone to wake up or find time is already done when people arrive.
- An advisory webhook that triages against the real dependency graph and files only what is reachable.
- A scheduled access-and-permissions review of the auth layer.
What changes
Security questions get answered from the code, not from a spreadsheet of what someone believed it did.
Where it stops. The channel is the boundary. Everyone in a bound channel has the same reach, and PRCHD keeps no identities or per-person permissions of its own — if your compliance story needs roles inside the tool, this is not that tool.
Other roles
The same host answers the rest of the team.
Product managers
@PRCHD is the export limit still 500 rows, and where is it enforced?
Product questions get answered from the code, without booking an engineer.
Engineering managers
@PRCHD what’s changed on main since Friday, and what’s risky in it?
The status an engineering manager currently assembles by asking five people assembles itself.
Founders and CTOs
@PRCHD how hard would it be to support a second currency?
Leadership gets ground truth directly, at 22:00, without pulling anyone off anything.
Where your code lives
The computer you own is the computer that runs.
Repositories, worktrees, prompts, transcripts, diffs, command output, attachments, environment values, and the event log stay on the computer you installed PRCHD on — the one that already has your code and your tools. The agent works there, so there is nothing to copy into a hosted environment and nothing uploaded to be indexed.
One small public service handles what a computer with no open port can’t do on its own: it enrolls your computer’s identity, forwards short push notifications, and holds webhook deliveries until your computer collects them. Each delivery is sealed to your computer’s public key the moment it arrives, so the service only ever holds ciphertext, and it is never in the path of your work.
Standing watch
Send this to whoever runs the shared computer.
One person installs it — an afternoon, not a migration. Everyone else asks from a Slack channel they’re already in, and nobody creates an account, installs an app, or pairs a phone.