For people shipping code they didn't fully read

Scan your AI-generated code before you ship.

Paste a public GitHub repo. We find committed secrets, vulnerable dependencies, and dangerous patterns. Each finding ships with a paste-ready prompt for Claude Code or Cursor.

Public repos only. We do a shallow clone, scan in memory, and delete the clone when done. Your code is never stored.

Looking for a live website scan instead? Try the URL scanner →

What it catches

Committed secrets

AWS, Stripe, OpenAI, Anthropic, GitHub PAT, GCP service accounts, JWTs, private keys, and high-entropy values assigned to credential-like variables.

Vulnerable dependencies

npm, PyPI, Go, RubyGems, and Cargo manifests checked against OSV.dev. Severity, affected versions, and the next safe version are surfaced per finding.

Dangerous code patterns

eval, exec, pickle.loads, dangerouslySetInnerHTML, string-concatenated SQL, shell=True subprocess, Django DEBUG=True, CORS allow-all, and more.

Paste-ready fix prompts

Every finding ships with a one-paragraph prompt you can paste into Claude Code or Cursor. We tell the assistant where the issue is and exactly how to fix it.

How it works

  1. 1

    Paste a repo URL

    Public GitHub repos only. No login, no install, no GitHub app required.

  2. 2

    We scan it

    Shallow clone, three scanners run in parallel (secrets, deps, patterns), then the clone is deleted.

  3. 3

    Get a report with fix prompts

    Findings sorted by severity. Each one has a paste-ready prompt for your AI coding assistant.

Built for vibe coders

If you ship code from Cursor, Lovable, Bolt, v0, or Claude Code, this is the last gate before production. It's free, takes about a minute, and you never have to install anything.