Find out what is putting your app at risk.
Including Supabase, Firebase, Vercel, Next.js, React, Python, Go, Stripe, Netlify, Vue.js, Svelte, Node.js, Express, Django, Flask, FastAPI, Rust, Spring, Laravel, Ruby on Rails, PHP, GitHub, Replit, Cursor and more.
PRODUCT
Code, dependencies, secrets, database rules and the live site, checked together and ranked by what matters.
Connect GitHub or drop a zip, then add your live URL: code and running site are checked together. No code to share? Scan just the live site, free.
Scan your repo, read findings and get fix prompts inside Claude, Cursor, Codex, Lovable or Replit. No API key needed.
Point it at a repo or a zip, and add your live URL. Every check runs together and comes back ranked, each with a fix.
github.com/you/your-appEvery issue comes with a ready prompt. Paste it into Cursor, Claude Code or Copilot and it gets fixed in place.
Secrets, access control, database rules, dependencies, API config, business logic and infrastructure.
Fix, rescan and see what changed. Unchanged code rescans free.
setrepo / your-app
Fixed · Service role key in browser code
src/lib/supabase.ts
Fixed · Admin endpoint has no auth check
app/api/admin/users/route.ts
New · Order total taken from the request
api/checkout.py
Start scans and read findings from scripts, CI or an AI agent. The API and dashboard share the same credit balance.
SCANS
Each scanner looks for a different way apps get broken into. They run together, and you get one ranked list with a fix for each finding.
git log --all · 6 commits
- STRIPE_SECRET_KEY="sk_live_••••••••••••"
Critical · Deleted in a later commit, but still in history. Rotate the key.
USE CASES
Find out what's exposed before your first users do.
Run a free scan and see where you stand before paying anything.
IDOR on /api/notes/:id
Anyone can read other users' notes by changing the ID.
No security jargon. Each finding says what's wrong and what to change.
A one-time deep scan includes a free rescan within 7 days.
SECURITY
Read-only access, hardened scans, and secret values redacted before anything is stored.
Confidence labels
Uncertain findings are marked 'verify', never shown as critical.
A second look by AI
On deep scans, AI review re-checks uncertain critical and high findings.
You have the final say
Mark a false positive and it's gone from your report.
You can export or delete all your data from your account at any time.
FREE CHECKS
Start with 100 free credits per month for Quick and URL scans. You get your grade and every issue we find. Unlock the exact locations and fixes when you're ready.
No credit card.
your-app · Quick scanDeep scan
1 critical · 34 high · 6 medium
CriticalService role key used in browser code
HighAdmin endpoint has no auth check
HighOrder total taken from the request
HighCORS allows any origin with credentials
BLOG
Plain-English guides to the security issues we find most, and how to fix them.
Change one number in a URL and see someone else's data. It's the most common way logged-in users read what isn't theirs.
A key in your code or git history works for whoever finds it. Deleting it later doesn't help; rotating it does.
With Row Level Security off, your public anon key can read every row. One SQL line turns it back on.
An admin endpoint that nobody linked to is still on the internet. If it doesn't check who's calling, anyone can use it.
Gluing user input into a SQL string lets that input rewrite the query. Parameterized queries stop it completely.
If the checkout reads the total from the request, the buyer decides what they pay. Prices belong on the server.
Allowing any origin with credentials lets other websites act as your signed-in users. List the origins you trust instead.
Most of your app is code you didn't write. A package with a known vulnerability is a known way in until you upgrade it.
Your Firebase API key isn't the secret, your rules are. Test-mode or open rules let anyone read and change everything.
The service_role key skips Row Level Security completely. If it's in your browser code, anyone can read, change or delete all of your data.
JWT verification, mass assignment, security headers, rate limits and more.
All checksPRICING
Start with 100 free credits each month. Choose a plan for more credits.
$0forever
No credit card
$2.99one-time
$6.99 for large repos
$2.99 per scan
$19.99/mo
$44.99/mo
A scan that fails on our side gets a free rescan. Cancel anytime.
Free includes 100 credits per month for Quick and URL scans. Starter includes 1,200 credits and Pro 3,000 credits per month, shared across Quick, Deep, URL, API and MCP scans. Different scans use different amounts based on resource usage. Review the estimate and authorize a maximum before processing. Actual usage settles afterward; unused reservations return to your balance. Viewing reports, downloads and existing fix prompts use no credits.
Yes. Choose Live URL only to check HTTPS, certificates, headers, cookies, DNS, email records and public JavaScript. Review and authorize the credit maximum before starting. Add the code later for checks that need repository access. Per-site abuse protections still apply.
When nothing changed, yes: a Deep scan of the same code as that project's last Deep scan (the same commit, or the same files in a zip) isn't run or charged, on any plan. You get that report again, and if you added a live URL its site checks run again for free. A one-time Deep scan also includes one free rescan of the same project within 7 days, to check your fixes. It covers a repo of the same size price or smaller.
Credits renew monthly, including on annual plans. Annual subscribers receive credits monthly, not upfront. Unused subscription credits expire each cycle without rollover. Scan any number of projects, subject to technical and fair-use safeguards. Existing purchased scans and eligible rescans keep their original rights.
We size it before execution and show the credit estimate and maximum reservation. Unsupported repositories remain subject to scan size and safety limits. One-time Deep scans cost $2.99 for standard repos and $6.99 for large repos.
Not on its own. No scanner catches every issue. Each report shows exactly what SetRepo checked and what it didn't, and a good grade means those checks didn't find a problem. Results are information to act on, not a guarantee or a certification. Details are in the Terms.
Yes, anytime, in Settings → Billing. Switching between Starter and Pro is prorated. When you cancel, you keep your plan until the end of the period you've paid for, and you won't be charged again.
A one-off Deep scan isn't refunded once it has started. If it fails on our side, you get a free rescan of the same project automatically. A subscription payment is refunded in full if you ask within 48 hours and haven't run a scan in that billing period; after a scan or after 48 hours, it isn't. Email support@setrepo.com to ask.