Is the free scan really free?

Yes. Every new account created from this page gets one scan of one repository at no cost. No card is needed. Connect your repository and start it within 48 hours of signing up.

What if nothing is found?

Then you have your answer and nothing to pay. The free scan is yours to keep, whatever it finds.

What does the free scan show?

Every finding in your repository, counted, rated by severity and named by the kind of weakness. The most serious finding with solid proof opens in full, with the exact lines and the route through your code.

How do I see the rest?

Buy one scan for that repository or choose a plan. Every finding of your free scan opens at once, no new scan needed, and fix proposals are prepared for the most important ones.

Will the scan change my code?

No. The scan reads one pinned commit with a token that can only read. Nothing is written to your repository.

Which code can I scan?

A private or public repository on GitHub or on any GitLab host, connected with a token that can read it. One free scan per account and per repository.

What do I need to start?

An email address and a password to sign up, and a token that can read the repository. Before the scan starts you confirm your email and add an authenticator app, which takes a minute.

Is your code safe? Find out for free.

Free code security scan. Value of one scan $149.50. Free for your first repository.

Get the security scan our customers pay $149.50 for, on one repository of your choice. See every vulnerability counted and rated before you spend anything. If your code comes back clean, you owe nothing.

New accounts only. A limited number of free scans each month.

No card needed
Read-only access
Nothing written to your code

Start my free scan

One free scan. Two possible answers.

Either way you know where your code stands before you spend anything.

If your code is clean. Nothing to fix.: Your scan comes back clean. You keep the result and there is nothing to buy. Peace of mind at no cost.
If something is found. You see what is at stake.: Every finding counted, rated by severity and named by its kind. The most serious one with solid proof opens in full. You unlock the rest only if you want to.

Find out which one is yours

Everything in your free scan.

A real security scan.: The same scan customers pay for, on one repository of your choice.
Every finding, counted and rated.: Critical, high, medium or low. You see how urgent it is at a glance.
Named by its kind.: SQL injection, broken access control, path traversal. You know what you are dealing with.
One critical finding in full.: The most serious finding with solid proof opens with its exact lines and the route through your code.
No pressure to buy.: Unlock every finding and fixes for the most important ones with one scan or a plan, when you choose.

Value $149.50. Your price Free.

Three steps. Then you know.

No card and nothing to install. Your code is read, never changed.

Create your account. Your name, email and a password. You are in the app right away.
Connect one repository. GitHub or any GitLab host, with a token that can only read. Start within 48 hours of signing up.
Get your answer. Confirm your email and add an authenticator app, it takes a minute. Then every finding is counted, rated and named.

What your free scan looks for.

The weaknesses attackers use most, across your whole repository. Each finding names its kind, so you know what you are dealing with.

SQL injection (CWE-89): Input that ends up inside a database query.
Missing authorization (CWE-862): Data one user can reach that belongs to another.
Authentication weakness (CWE-287): Ways around the sign-in that guards your app.
Command injection (CWE-78): Input that reaches a shell command on your server.
Server-side request forgery (CWE-918): Requests your server sends wherever an attacker points it.
Path traversal (CWE-22): File reads and writes outside the folder they belong to.
Cross-site scripting (CWE-79): Input written into a page that runs in the browsers of your users.
Unsafe deserialization (CWE-502): Data that can build any object when your code reads it.
Secret exposure (CWE-798): Keys and passwords written into the code itself.
Unrestricted file upload (CWE-434): Uploads that can place a runnable file on your server.
Mass assignment (CWE-915): Fields a request can set that it never should.
Vulnerable dependency (Advisory): Packages with a known, published vulnerability.

And 30 more kinds of weakness, from weak cryptography to race conditions.

Scan my code free

Pay only if you want the details.

Your free scan costs nothing, whatever it finds. To open every finding and get fixes, unlock it with one scan or keep the repository covered. Prices in USD per repository, taxes are added at checkout.

Your free scan. One repository. Every finding counted, rated and named, the most serious one with solid proof in full. Start it within 48 hours of signing up.

One-time scan

$149.50 per scan. Paid once. No subscription. Unlocks your free scan for that repository at once. No new scan, no waiting.

Every finding in full
Fix proposals you review
The full report

Continuous

$399.60 per month with yearly billing, $4,795.20 a year. Yearly billing saves 20%. $499.50 per month with monthly billing. Unlocks your free scan and keeps the repository under continuous audit.

Your free scan unlocked at once
Each push checked against the last known state
Fix proposals you review

Enterprise

$1,199.60 per month with yearly billing, $14,395.20 a year. Yearly billing saves 20%. $1,499.50 per month with monthly billing. Up to five repositories under continuous audit, with a team behind you.

Everything in Continuous
Up to 5 repositories
Enterprise support with an SLA
Priority queue for scans

Start with one scan. Upgrade to Continuous or Enterprise within 14 days and the $149.50 you paid comes off your first payment, monthly or yearly. One credit per account.

Questions about the free scan

Is the free scan really free?: Yes. Every new account created from this page gets one scan of one repository at no cost. No card is needed. Connect your repository and start it within 48 hours of signing up.
What if nothing is found?: Then you have your answer and nothing to pay. The free scan is yours to keep, whatever it finds.
What does the free scan show?: Every finding in your repository, counted, rated by severity and named by the kind of weakness. The most serious finding with solid proof opens in full, with the exact lines and the route through your code.
How do I see the rest?: Buy one scan for that repository or choose a plan. Every finding of your free scan opens at once, no new scan needed, and fix proposals are prepared for the most important ones.
Will the scan change my code?: No. The scan reads one pinned commit with a token that can only read. Nothing is written to your repository.
Which code can I scan?: A private or public repository on GitHub or on any GitLab host, connected with a token that can read it. One free scan per account and per repository.
What do I need to start?: An email address and a password to sign up, and a token that can read the repository. Before the scan starts you confirm your email and add an authenticator app, which takes a minute.