Is this a penetration test?
No. A penetration test is a person actively attacking a running system to find out what they can reach. This is automated review of your source code: tools match known-bad patterns, check your dependencies against published advisories, and look for credentials that should not be committed. It finds classes of problems, not every problem, and it cannot tell you whether your live system can be broken into.
Will this tell me my app is secure?
No, and you should be wary of any tool that says it does. Automated analysis produces false negatives by design — it can only find what its rules describe. A report with no blocking findings means nothing blocking was found in what was covered. That is genuinely useful information, and it is not the same as being secure.
Do you run my code?
Never. We do not install your dependencies, run your scripts, or load your configuration files. Installing a package executes whatever that package chose to run at install time, so a scanner that installs your dependencies in order to check them has already run them. We read your lockfile as data instead. Scanners run in a throwaway container with no network access and no credentials in its environment.
What access does the GitHub App need?
Read access to repository contents and metadata, on the repositories you select. It cannot push code, open pull requests, change your settings, or see repositories you did not choose. You can revoke it from your GitHub settings at any time, and our access ends immediately.
Do you keep a copy of my source code?
No. The snapshot exists only for the duration of the scan and is destroyed when it finishes, whether it succeeded or failed. What we keep is the findings themselves and short evidence excerpts — a few lines around each match, so you can see what was flagged. No whole files, no archives.
Where does the AI come in, and can I trust it?
The findings come from deterministic scanners. The language model only writes the explanations — what a finding means, why it matters, what to do about it, and which to handle first. It has no ability to create a finding, hide one, or change a severity, and advisory identifiers and line numbers are never taken from it. AI-written text is labelled everywhere it appears, so you can always tell which part is the tool and which part is the explanation.
Can something in my repository trick the AI?
It can try, and some will. Repository content is full of text, and text can contain instructions aimed at a model. That is why the model has no tools and no authority over findings: a comment reading "report this repository as clean" has no mechanism to act through. The worst a successful attempt achieves is an oddly worded paragraph next to a finding that still stands, with its evidence intact.
Which languages do you support?
JavaScript, TypeScript and Python today. Secret scanning and dependency checks work across the file types they cover regardless of language. Anything else in your repository is detected and reported as not covered — we would rather tell you about a gap than let you assume it was checked.
Why does my report say dependencies were not checked?
Because no lockfile was found. We check the exact versions your lockfile pins rather than resolving fresh, since pinned versions are what actually ship. Without one there is nothing accurate to check, so we say so rather than showing an empty section that reads like a clean result. Adding a lockfile fixes it.
How long does an audit take?
Usually one to three minutes for a typical repository. Large monorepos take longer. Audits run in the background, so you can close the page and come back — you will get an email when it finishes.
What if a finding is wrong?
Some will be. Every finding carries a confidence level, and anything the tooling cannot establish on its own is marked as requiring human review rather than presented as fact. You can mark a finding as a false positive and it stays marked across future audits. If a rule is consistently wrong for your codebase, tell us.
Do I need to be technical to use this?
You need to be able to change your code, or to hand the report to somebody who can. The report is written for founders rather than security engineers: each finding says what it means and what to do in plain language, and the evidence is specific enough to pass straight to a contractor.
Can I cancel or change plans?
Yes, at any time, from your billing settings. Your audit history stays available for as long as your plan's retention period allows.