About Nic Chin

Why SystemAudit.dev exists

More software is being shipped by people who did not write it. AI coding tools made that normal, and the gap between “it works” and “we know what it does” got wider. The people carrying that risk — founders, acquirers, CTOs who inherited a repository — usually cannot read the code themselves, and a traditional audit takes weeks and five figures.

SystemAudit.dev exists to close that gap in three minutes: paste a GitHub link and get an architecture map, a security scan, hidden risks, and a prioritized fix plan, written so a non-developer can act on it.

How the findings are kept honest

An audit tool that invents problems is worse than no audit tool, because it spends your team's time on work that was never needed. Every finding is checked against the actual source: the engine drops or downgrades any issue it cannot tie to a specific file and line, and corrects claims that contradict measured facts — real test-file counts, real configuration, real file contents.

Coverage is reported as a ratio — files analysed out of files in the repository — so a report never implies more of a codebase was read than actually was. The scanner does not clone your repository; it reads a capped subset of files through GitHub's API and stores none of it.

Why the scanner engine is open source

The detection engine is MIT-licensed and public. A security tool asking you to trust its output should let you read how it decides — what counts as a secret, what counts as a risk, and where it stops. You can check the rules yourself rather than take the grade on faith.

Writing

The blog covers what actually breaks in codebases that shipped fast: supply-chain attacks as they happen, what investors look for in technical due diligence, and how to read a code audit report if you are not technical.