Docs.
Kelp is small on purpose. Two short quickstarts get you running; the rest is reference material for when you want to extend it or verify how it works.
Start here
Reference
Full markdown on GitHubArchitecture ↗
How the CLI, worker, and hosted app share one detection engine. Package boundaries, scan pipeline, a where-do-I-look cheat sheet.
CLI reference ↗
Every command, every flag, exit codes, JSON output schema, comparison with the Action and hosted surfaces.
Evidence gating ↗
The anti-fabrication invariant behind every Kelp finding — the model never decides a finding is real.
Security model ↗
What Kelp does and doesn't verify. Threat model against Kelp itself. What's in and out of scope.
Backend adapters ↗
The north star for extending Kelp beyond Supabase (Firebase, Convex, Neon, PocketBase). Priority order + contributor checklist.
Contributing ↗
Dev setup, conventions, first-detection walkthrough. Read this before opening a PR.
Security policy ↗
How to responsibly report a vulnerability in Kelp itself. Do NOT use public issues.