Developer-friendly automated security feedback in pull requests

Deliver fast, actionable security feedback in PRs. Add SAST checks, reduce noise, auto-create triage tickets, and coach developers without blocking me