Security scans

Security scanning for your
GitHub repositories.

Find leaked secrets, vulnerable packages and security bugs across a whole repository. Share a PDF report with your team or a customer, and let Codzee open the fix for vulnerable npm packages.

Start free trial

14-day free trial · No credit card · Free for solo developers and open source

How scans work

What a scan finds

Four checks, one scan.

How a security scan works
  1. Your repositoryone commit of the branch you pick
  2. Isolated sandboxread-only access, code never run, deleted afterwards
  3. Leaked secretsgitleaks
    Vulnerable packagesTrivy, OSV-Scanner, govulncheck, retire.js
    Python issuesbandit
    AI security reviewchecked twice before it counts
  4. Findingsseverity, CVSS or CWE, new / open / fixed
  5. PDF and JSON reportto share with your team or a customer
    Fix pull requestfor vulnerable npm packages

Leaked secrets

API keys, tokens, passwords and private keys committed to the repository, found with gitleaks. Codzee keeps a hash, never the secret.

Vulnerable packages

Dependencies with known vulnerabilities, from your lockfiles, found with Trivy, OSV-Scanner, govulncheck and retire.js.

Python code issues

Unsafe patterns such as shell injection or weak cryptography, found with bandit.

Security bugs in your code

An AI review of your riskiest files: access control, injection, SSRF, path traversal and more. A second pass checks every finding.

Reports and fixes

Findings you can act on.

A PDF report to share

Scope, counts by severity, every finding with CVSS or CWE and a link to the code, how to fix it, and what was fixed since the last scan. JSON too.

Track scan to scan

Each finding is marked New, Still open or Fixed against the repository's previous scan, so you can see progress.

Fix pull requests

For a vulnerable npm package, Codzee opens a pull request with the nearest safe patch or minor version and an updated lockfile. You review and merge.

Safe with your code

Each scan runs in an isolated sandbox that is deleted afterwards. Read-only GitHub access, revoked once the code is downloaded. Your code is never run.

Questions

Security scans, answered.

Does a scan use up my reviewed pull requests?
No. Security scans and fix pull requests don't count as reviewed pull requests. Security scans are included on Team and Enterprise, and in the 14-day trial. Each organization can run 20 scans and open 20 fix pull requests a month.
How is this different from Codzee's pull request review?
Reviews look at each pull request as it's opened, and flag security risks in the changed code. A scan checks the whole repository, including code written before Codzee, and the packages it depends on.
Which languages and package managers?
Secrets and the AI review work on any language. Vulnerable packages are found for npm, Yarn, pnpm, pip, Pipenv, Poetry, uv, Go, Cargo, Bundler, Composer, Maven, Gradle, NuGet, pub and Mix. bandit checks Python code.
Is it a penetration test?
No. A scan reads your source code and your dependencies. It doesn't test running systems or deployed configuration, and the report says so.
Who can run a scan?
Admins start scans and fixes. Everyone in your organization can see the results and download the reports.
Does Codzee keep my code?
No. The repository is copied into a sandbox that is deleted when the scan ends. Only findings and reports are kept; a finding can quote a few lines, and secret values are never stored.

How Codzee handles your data: Security and data handling.

Scan your first repository today.

Security scans are included on Team and Enterprise, and in the 14-day trial.

Start free trial

14-day free trial · No credit card · Free for solo developers and open source

Security Scanning for GitHub Repositories | Codzee