What the free scan does and does not do.
Paste a public repository link or upload private code as a ZIP. Get counts, example locations and fix hints grouped by bug class.
Five checks: swallowed write failures, undefined names, hardcoded secrets, fail-open flags, and stale secret capture. Python is supported; secret literals are also checked in .service, .conf and .env files. These are heuristic checks, not a complete security audit or proof that code is safe.
Submitted code is never executed. Report links last 24 hours. GitHub App connections and automated fix PRs are not available.