See a scan, end to end.
Nine real screens from a scan of a public repository, in the order you meet them. Click a highlight to move on, or use the arrows and your ← → keys.
Signing in
GitHub or Google. The first sign-in asks for an email address and nothing else. A private repo needs a read-only connection you grant separately, later, if you ever want one.
One score, every repo
Everything you have scanned rolls into a single portfolio score and a grade. The chart underneath is that score over time, so a month of fixes is something you can point at.
Starting a scan
Paste the URL of any GitHub repository you own or have permission to scan. Nothing to install, no CI to wire up, no config file to commit first.
Watching it run
Each stage reports as it finishes, with a live scanner log. This clip is sped up 10x; the real scan ran just under two minutes. You can close the tab, it keeps going.
The verdict first
A letter grade and a score out of 100 before a single finding. This repository scored 16 and earned an F: 32 critical, 63 high, 63 medium, 13 low, across 171 findings.
A prompt, not a PDF
One prompt covering the 25 worst findings, written for the tool you actually use. Pick Claude Code, Cursor, Copilot, ChatGPT, Gemini or Lovable, copy it, and let the tool make the edits.
Worst first
Findings group by severity with critical at the top. Each row names the file and the line, then says in plain English what somebody does with it.
Why it is not noise
Open a finding and it argues its own case: why this one is not a false positive, and the fix, with the corrected code. Nothing asks you to take the scanner's word for it.
The inventory
A CycloneDX bill of materials for every third-party package, with versions and licences. The panel on the right is the honest part: it lists what this document does not tell you.
A scan reads a whole repository and tells you what an attacker would find first.