Leaked secrets, known CVEs in dependencies, unsafe GitHub Actions, Terraform and Kubernetes misconfiguration. Where a fix can be written, it arrives as a pull request you review and merge — not a ticket you have to write.
Hardcoded secrets, no CI/CD, outdated dependencies — teams find out only when something breaks.
A library is not asked for a Dockerfile, a docs site not for tests. About 5 seconds per public repository.
No agents or manual configuration
Any public repository, no account needed. Here are a few to start with.
Annual billing saves 20%. Team seats are included — you pay per organisation, not per engineer.
Sign in with GitHub or GitLab, or paste an access token. An audit only reads, and nothing is written to a repository until you open a fix yourself. Note that GitHub sign-in grants the repo permission, which GitHub does not split into read and write — for strictly read-only access, paste a fine-grained token with read permissions instead. Stored tokens are encrypted. The Trust page lists what is read and what never leaves. Trust page →
Nothing, unless AI analysis is switched on in your profile. When it is: the failed checks with our recommendations, facts about the repository, and up to 12 configuration files (Dockerfiles, CI workflows, Kubernetes, Terraform) — never application source code, and anything that looks like a credential is masked first. Turn it off and reports keep their advice, written by built-in rules.
Dependabot updates dependencies; Scorecard grades security practices. DevOpsCheck covers both areas plus Docker, Terraform, Kubernetes and GitHub Actions supply chain in one report with one score — and where a fix can be written, it opens the pull request.
Yes. Connect with a GitLab token, including instances on internal networks with their own certificates and DNS. Fixes arrive as merge requests.
Not as a packaged install yet. If you need it inside a closed network, write to us — it is on the roadmap.
Scanning public repositories is free and needs no account. A free account covers private repositories up to a limit; paid plans add AI analysis, fix pull requests and team features.
Public repositories are free and need no account.