See a scan, end to end.
Eleven real screens from a scan of a public repository, in the order you meet them. Click a highlight to move on, or use the arrows and your ← → keys.
Signing in
GitHub or Google. Signing in never asks for access to your code, and a public repo can be scanned from its link alone. A private repo needs a read-only connection you grant separately, if you ever want one.
Every risk in one view
Every repository in the workspace rolls up into one view: open risks, how many are critical or high, how many already have a fix, and where they sit across your code, dependencies and secrets.
Starting a scan
Paste the link to any GitHub repository you own or have permission to scan, or pick one you have scanned before. Nothing to install, no CI to wire up, no config file to commit first.
Watching it run
Each stage reports as it finishes, ending with your code being deleted from the scanner. This scan took 54 seconds; the clip is shortened. You can close the tab, it keeps going.
The verdict first
A grade and a score out of 100 before a single finding. This repository's first scan graded C, 67 out of 100, across 20 findings, with a one-line verdict: worth fixing before you share it widely.
Worst first
All 20 findings, grouped by severity with critical at the top. Each one names the rule, the file and the line, then says in plain English what somebody could do with it.
Each finding makes its case
Open a finding for the full case: what goes wrong, where, and what the AI review concluded. When the code alone cannot settle it, the review says so plainly and asks a person to look.
How an attacker gets there
The attack path maps the weakness to MITRE ATT&CK, from how a request reaches the code to what it exploits. It shows the likely route, not proof, and the fix with corrected code follows it.
Where the risk sits
The Map tab draws the repository as a graph: folders, files sized by risk, and each finding pinned where it lives. Beside it, the files that cost your score most, worst first.
A prompt, not a PDF
One prompt for the issues worth fixing, written for the tool you use: Claude Code, Cursor, Lovable, ChatGPT, Gemini or any other. Copy it, paste it, and the tool makes the edits.
A record of every scan
Audit logs keep every step of every scan for 90 days, down to the moment the scanner deleted your code. Filter, search, and download the log whenever someone asks.
A scan reads a whole repository and tells you what an attacker would find first.