Security
Security Review
Find leaked secrets and dependencies with published vulnerabilities.
Free basic scan
- 0 credits · top 5 findings
- Summary, score and the most important problems
- Download the report as Markdown or JSON
Full report
From about 5 credits for a typical project
- Every secret and vulnerable package
- Up to 20,000 files
- Fix version for each package
- Findings become tickets in one click
Who it is for
Developers, agencies and CTOs
- Check a project before handing it to a client
- Find leaked keys before a release
- Get fix versions for vulnerable packages
Why use this instead of Snyk, GitGuardian, Dependabot?
- Secrets, vulnerable packages, risky code and licenses in one pass, without connecting GitHub
- Exact fixed version for each vulnerable package (npm, Python, Go, Rust, PHP, Ruby)
- Software bill of materials (SBOM) in the JSON download
- Secrets are masked; each finding becomes a ticket with the fix
How it works
- Scan text files for secrets
- Check risky code patterns
- Collect dependency versions and licenses
- Check them against OSV.dev with fix versions
- Rank findings by severity
What we read
Text files in your ZIP and the package names and versions from your manifests (sent to the public OSV vulnerability database).
Limits: Covers secrets patterns and known-vulnerable packages. It is not a full code audit or penetration test.
New in every tool
Live progress
Watch every step line by line, with percentages, so you know it is working.
Connect GitHub or GitLab
Scan your latest code straight from your repository — private repos too.
Share your score
Post your result on LinkedIn, X or WhatsApp. No code or secrets are ever shown.
Earn while you use it
Let clients pay for runs at +30% and keep the extra, or invite people and get 20% of what they pay.
Firm price first
You see the exact credits before a full report. Failed runs cost nothing.
Ask for more
Missing something? Send us an idea right inside the tool.
History and comparison
Every run is kept. See new, fixed and remaining problems against any earlier run.
AI assistant on every page
Speak or type — the assistant fills the tool's form for you and explains the results.
Questions
- Is Security Review free?
- Yes — the basic scan is free and shows the top 5 findings. The full report costs a few credits, and every new account gets 25 credits.
- How is it different from Snyk, GitGuardian, Dependabot?
- Secrets, vulnerable packages, risky code and licenses in one pass, without connecting GitHub. Exact fixed version for each vulnerable package (npm, Python, Go, Rust, PHP, Ruby). Software bill of materials (SBOM) in the JSON download. Secrets are masked; each finding becomes a ticket with the fix.
- Who is it for?
- Developers, agencies and CTOs. Check a project before handing it to a client. Find leaked keys before a release. Get fix versions for vulnerable packages.
- What data do you read?
- Text files in your ZIP and the package names and versions from your manifests (sent to the public OSV vulnerability database).
- What are the limits?
- Covers secrets patterns and known-vulnerable packages. It is not a full code audit or penetration test.
- Can my client pay for it?
- Yes. Share a link: you pay, your client pays the regular cost, or your client pays the cost + 30% and the extra becomes your reward, which you can withdraw monthly.
Other IT tools
- Project Plan — Turn an idea or brief into scope, milestones, tasks, risks and acceptance criteria.
- Code Health (ZIP) — Map a codebase: languages, size, dependencies, structure and technical debt signals.
- Test Gaps & Edge Cases — Show which modules have no tests and suggest the edge cases worth testing first.
- DevOps Readiness — Checklist for shipping: CI, containers, secrets handling, migrations, health checks, monitoring.
- Site Growth Audit — Technical SEO and AI-visibility quick scan: crawlability, metadata, structured data, links.
- Website Monitor — Check that your site is up, fast, on HTTPS and unchanged — once now or on a schedule.
- API Testing — Call your API endpoints, check status, speed and JSON, and try common negative cases.
- One-Page SEO Check — Check one page for Google and AI search: title, description, headings, links, images, speed signals and structured data.
- Accessibility Audit (WCAG) — Find the most common WCAG problems on a page: missing alt text, labels, language, heading order, link and button names.
- Playwright Test Generator — Give a page address and get ready-to-run Playwright tests for its links, forms and buttons.
- Page Regression Check — Compare a page with its last check: title, headings, links, images, forms and scripts that appeared or disappeared.
- Load Test (light) — Send a short burst of requests to your page and see response times, slowest requests and errors under load.
- Infrastructure Starter (Terraform, Docker, CI) — Describe the app and get a Dockerfile, a GitHub Actions pipeline and Terraform files to launch it.
- SSL & Domain Expiry — See when the certificate and the domain name expire, plus HTTPS and redirect problems.
- Quote Builder — Describe the job and get a professional quote with line items, hours and totals — then turn it into an invoice in one click.