01
Connect GitHub
Sign in with GitHub. Bao reads repos, PRs, branch protection, Actions runs, and config files. From there it identifies the rest of your stack.
02
Bao reads everything
With approval, Bao connects to Vercel, Supabase, Sentry, and AWS read-only. Six signals evaluated against the playbook senior engineers run before shipping.
03
Plain-English fixes, daily
Each morning: score, ranked issues, Days Until Break. Team plans get auto-fix proposals as PRs to approve, reject, or modify.
The principle
No agents. No installs. Read-only by default.
No agent in your runtime, no CI/CD changes. Bao reads what your stack already produces. Read-only unless you opt into auto-fix — and every proposal is a PR you approve.
| Agent install | None. Bao runs from outside your runtime. |
|---|---|
| CI/CD changes | None required. Bao reads what your existing pipeline already emits. |
| Access mode | Read-only by default. Write access opt-in, per integration. |
| Auto-fix | Proposed as PRs and Terraform diffs you review and merge. |
| Data handling | Bao reads metadata and configuration. Source code stays in your repos. |
Five-minute setup. Free forever for solo developers.
Sign in with GitHub, connect one project. First score same day.