Vuln ScannerAI-assisted vulnerability scanning

Connect a GitHub or GitLab repository and get real security findings in minutes — deterministic tools plus AI code review, no infrastructure to manage.

Get Started

Public API

🔍

Static code analysis (SAST)

Semgrep scans every file against OWASP Top 10 and security-audit rule packs, plus deep language-specific coverage for JS/TS, Python, PHP, Go, Java, Ruby, C#, and more.

How scanning works

📦

Dependency scanning (SCA)

OSV-Scanner checks whatever lockfile your project already has — package-lock.json, composer.lock, go.sum — against the OSV vulnerability database. Nothing extra to configure.

How scanning works

🔑

Secrets detection

Gitleaks catches exposed API keys, credentials, and tokens committed by accident, on every push, before they sit in history any longer than they have to.

How scanning works

🏗️

Infrastructure misconfiguration

Trivy checks Dockerfiles, Terraform, Kubernetes manifests, and CloudFormation for real misconfigurations — like a container running as root — that source-code analysis alone never looks at.

How scanning works

🧠

AI code review

Claude reviews source files for the class of issue pattern-matching structurally can't catch — a missing authorization check three files away, an unsafe assumption about caller identity.

Language support

🔀

GitHub and GitLab, natively

Connect via GitHub App installation or GitLab OAuth. Every push and pull/merge request triggers a scan automatically, with results posted right back as a PR/MR comment.

Connecting repositories

🛠️

AI-suggested fix PRs

One click turns a finding into a real pull or merge request with a proposed patch — reviewed by a human before it ever merges, never applied automatically.

Findings & fixes

👥

Built for teams

Invite teammates with owner/member roles, share one view of every repository's findings, and keep everyone on the same page without passing around spreadsheets.

Account & team

🔔

Notifications that matter

Critical findings and access issues reach you immediately over Slack or email, not buried in a dashboard nobody checks until it's too late.

Notifications

🔌

A real public API — and MCP

Pull findings and scan history into your own tooling, or trigger a scan from CI, with org-scoped API keys and a versioned /v1 contract. The same data is also reachable as an MCP server for Claude Code, Claude Desktop, and Cursor.

Public API