Repo Scanner: check code before you run it.
Scan a public GitHub repo or source ZIP for malicious install scripts, hidden payloads, and obfuscated code. See the verdict and one finding with evidence free. Unlock all findings for $3.99, with no subscription required.
Check recruiter take-home projects, unfamiliar open-source tools, and AI-generated projects. Static review only — your code is never executed.
Not sure what to look for? Read the pre-run repository checklist.
What we check before you run it
Private repo?
Export a ZIP from your machine and upload it here.
We only read files statically — no install, no build, no execution.
Pricing
Free preview:
Risk signals, coverage, warning counts, and one finding with source evidence
Full report:
Every finding, exact evidence, network destinations, credential checks, and what to do next
$3.99 one-time
FAQ
Do you run my code?
No. The scanner only reads text from the repo or ZIP.
We never run npm, node, Python, shell scripts, binaries, builds, or installs.
Do you store secrets?
Recognized secret formats are masked before selected source files are sent to OpenAI. Detection is not exhaustive: remove sensitive credentials before uploading. Reports retain the reviewed file paths and redacted finding snippets.
What are the limits?
ZIPs are capped at 50 MB. The default free limit is 1 repo scan per day. AI reviews up to 80 selected files within a 240 KB text budget. Large files, binaries, and dependencies are skipped; your result shows the coverage.
Does a clean result mean the repo is safe?
No. It means no suspicious behavior was identified in the reviewed files. Static review can miss threats and does not verify downloaded dependencies or runtime behavior.
What is the refund policy?
Email us and we refund. No questions asked.