Getting started

Paste the link. On the home page, paste your public repository link and select Scan. A repository is the online folder holding your code. Try the demo if you do not have a link. For private code, upload a ZIP instead.
Read the findings. Similar issues are grouped together. Each group shows a count, example file and line, why it matters, and a fix hint. A queued scan starts when the current scan finishes.
Send the fix list to your developer. Select Email this report. Your email app opens with the report link and fix list ready to send. You choose the recipient and send it.

Sharing and privacy

Reports expire after 24 hours. Anyone with the link can read the file names and findings. Keep private-code report links private. We omit source snippets and delete submitted code after processing. See the Privacy Policy and Terms of Service.

Coverage and limits

Five checks: swallowed write failures, undefined names, hardcoded secrets, fail-open flags, and stale secret capture. Python is supported; secret literals are also checked in .service, .conf and .env files. These are heuristic checks, not a complete security audit or proof that code is safe.

Files larger than 1 MB and invalid Python files are skipped; reports show skipped and scanned file counts. Unsupported languages are not scanned. A zero-finding report is not a safety certificate.

Repository: 200 MB maximum. ZIP: 20 MB compressed and 200 MB expanded; at most 20,000 entries. Scan execution: 90 seconds. If the queue is full, try again later. Private GitHub connections are not available yet.