# Scan the whole repository, not just the next pull request

Security scans check the default branch for secrets, vulnerable dependencies, risky configuration and dangerous code patterns. Every finding is checked a second time before you see it.

[Start free trial](https://app.mergeharbor.com/signup) [Read the docs](https://mergeharbor.com/docs/security-scans)

mergeharbor bot An illustrative scan finding

.github/workflows/release.yml:14 · high · CWE-94

pull\_request\_target checks out the pull request's code and runs it with a write token.

Verified: rule re-checked on the exact line.

## How it works

1.  ### Run or schedule a scan

    Choose a repository and select Run scan, or schedule scans daily, weekly or monthly. The dialog shows the credits before anything runs.

2.  ### Check everything merged so far

    Free deterministic checks cover secrets, lockfiles, workflows, Dockerfiles, Terraform and Kubernetes. An optional AI pass reads the riskiest files from the code graph.

3.  ### Verify, then fix

    Each finding passes a second check and carries a CWE, an OWASP category and a fix. Open a fix pull request after you confirm.

## What you get

Findings keep their identity

Open, fixed and accepted-risk status carries over between scans, and a fixed finding that comes back is reopened.

Attack surface map

Routes, webhooks, queue consumers and commands, with the authentication detected at each. Public entry points are listed first.

SARIF and CSV export

Export findings, or upload them to GitHub code scanning after each scan. Uploading is off by default.

Capped cost

Deterministic checks are free. The AI pass is limited per scan, per repository per month, and by your organization's budget.

Documentation: [Security scans](https://mergeharbor.com/docs/security-scans)

## Frequently asked questions

Does a scan run my code?

No. Scans read files and history only. They never install dependencies or run repository code.

What does a scan cost?

Deterministic checks are free. The AI pass uses one credit per batch of high-risk files, within the per-scan and monthly caps you set. Turn it off to run only the free checks.

Have another question? [Ask our support team](https://mergeharbor.com/contact?topic=support)

## Explore other features

### Free security checks

Built-in checks on every pull request, at no cost

[Free security checks](https://mergeharbor.com/features/security-review)

### Codebase-aware review

Reviews that read your codebase, not just the diff

[Codebase-aware review](https://mergeharbor.com/features/review-agent)

### Insights

Time to merge, review quality and merge gate analytics

[Insights](https://mergeharbor.com/features/insights)

## Review every pull request with the context of your whole codebase

Connect a code host in minutes. Reviews start right away, and codebase context is added as indexing completes.

[Start free trial](https://app.mergeharbor.com/signup) [Book a demo](https://mergeharbor.com/contact?topic=sales&source=demo)