Public repositories are always free.
Compliance review on the pull request, for maintainers who keep the repository public. No application. No license check.
Public repositories are always free. No application or license verification. Eligibility is GitHub visibility: if the repository is public, reviews do not consume the private-repo allowance.
Install heygrc on your GitHub account or organization, then choose repositories. The check is neutral by default. heygrc does not make its check required. If your repository requires conversation resolution, you may still need to handle comments.
Visibility, not a license program
This page is for maintainers of public repositories. heygrc is not itself open-source software, and it does not inspect SPDX licenses. A public repo is free because it is public.
Free also includes 25 private-repository reviews a month. Paid private-repo plans are on the pricing page. A 14-day no-card trial is available when you claim the install in the console, not automatically at install.
See an example heyGRC check on a synthetic demo pull request. The control-in-code dataset is the open pattern library behind the reviews (CC BY 4.0).
heygrc | PR compliance review
Use this only on repositories heyGRC actually reviews.
[](https://heygrc.com/for/open-source)Changes that read as ordinary code.
A few of the control-relevant changes heygrc is built to flag for this case, each cited to the clause it touches.
An admin-only delete check is removed because auth already runs
SOC 2 CC6.1A noisy role-update log line is deleted
ISO 27001:2022 A.8.15A new email or phone column lands with no retention plan
GDPR Art. 5(1)(e)
The frameworks that matter most here.
Guide: What a compliance bot for GitHub actually does
heygrc flags control-relevant changes and cites the clause so the issue can be handled in the pull request. It does not certify you, run your audit, or replace your own judgment.