Everything your repository ships, checked before it does.
A local path on the server, or a public GitHub repo cloned just for the scan — analysed for dependency risk, secrets, container misconfiguration, risky code patterns, and LLM-usage risk in one pass.
Every layer of the repository, one scan
Dependency vulnerabilities
Known-vulnerable packages resolved across 8 package ecosystems via OSV.dev, the same open vulnerability database used across the industry.
Secrets detection
Hard-coded credentials, tokens, and keys caught in source before they ship — not just at the commit-hook stage.
Dockerfile & Kubernetes
Common container and manifest misconfigurations — permissive defaults, missing resource limits, exposed ports.
Pattern-based SAST
Rule-based static analysis surfaces risky code patterns without needing a full build or execution environment.
LLM usage risk
Flags patterns associated with unsafe LLM integration — unvalidated prompt construction, unbounded tool access.
CI/CD gating
The bundled CLI fails a pipeline when the score drops below a threshold you set — same engine as the web app.
SBOM export
A software bill of materials generated per repository scan, for supply-chain record-keeping.
In-toto attestations
Evidence that a scan ran against a given commit — not a SLSA build-provenance claim, but a real record.
Keep reading
Where most people go next
Field notes on code security
All articles
How to Find Secrets Already Committed to a Git Repository (and What to Do at 2 A.M.)
Deleting the file does nothing — the secret lives in history, clones, forks and caches. The search commands, the rotate-first order of operations, and how to prove the old credential is actually dead.
2 min read
EPSS vs CVSS: Why "Critical" Doesn't Mean "Fix First"
CVSS measures how bad exploitation would be. EPSS measures how likely it is in the next 30 days. Confusing the two is why teams patch alphabetically while the actually-exploited bug waits.
2 min read
A Vulnerable Dependency Was Found. Does It Actually Matter?
Most flagged dependencies are not exploitable in your application. Five questions that separate the ones that matter from the ones that generate tickets — and what to do when the answer is genuinely no.
3 min read
Try it on a real repository
Free to start, and reading your first repository in minutes.