Scan the whole repository, not just the next pull request
Security scans check the default branch for secrets, vulnerable dependencies, risky configuration and dangerous code patterns. Every finding is checked a second time before you see it.
.github/workflows/release.yml:14 · high · CWE-94
pull_request_target checks out the pull request's code and runs it with a write token.
Verified: rule re-checked on the exact line.
How it works
Run or schedule a scan
Choose a repository and select Run scan, or schedule scans daily, weekly or monthly. The dialog shows the credits before anything runs.
Check everything merged so far
Free deterministic checks cover secrets, lockfiles, workflows, Dockerfiles, Terraform and Kubernetes. An optional AI pass reads the riskiest files from the code graph.
Verify, then fix
Each finding passes a second check and carries a CWE, an OWASP category and a fix. Open a fix pull request after you confirm.
What you get
- Findings keep their identity
- Open, fixed and accepted-risk status carries over between scans, and a fixed finding that comes back is reopened.
- Attack surface map
- Routes, webhooks, queue consumers and commands, with the authentication detected at each. Public entry points are listed first.
- SARIF and CSV export
- Export findings, or upload them to GitHub code scanning after each scan. Uploading is off by default.
- Capped cost
- Deterministic checks are free. The AI pass is limited per scan, per repository per month, and by your organization's budget.
Frequently asked questions
Does a scan run my code?
No. Scans read files and history only. They never install dependencies or run repository code.
What does a scan cost?
Deterministic checks are free. The AI pass uses one credit per batch of high-risk files, within the per-scan and monthly caps you set. Turn it off to run only the free checks.
Have another question? Ask our support team
Review every pull request with the context of your whole codebase
Connect a code host in minutes. Reviews start right away, and codebase context is added as indexing completes.