SetRepo FAQ
Last updated
Short answers to the questions people ask most about SetRepo: safety, your code, AI and accuracy.
Is SetRepo safe?
Yes: SetRepo reads your code read-only, deletes it when the scan ends, and never stores secret values or uses the keys it finds.
GitHub access is read-only and scoped per repo, with a token that lasts at most an hour and isn't stored. SetRepo doesn't run your code. Findings are saved with secret values replaced by [REDACTED]. Details: setrepo.com/security.
Does SetRepo store my code?
No: your source files are deleted when the scan finishes, and only the findings are kept.
A finding keeps the file path, line numbers, a description and a fix, which can quote a short piece of code, with secrets redacted. SetRepo also keeps a hash of each file so a rescan can tell what changed. The one exception: a zip from a finished Quick scan is kept for up to 24 hours so you can upgrade it to a Deep scan, then deleted.
Does SetRepo send my code to AI?
Only on a Deep scan, and only the parts the AI review needs, with secrets redacted; a Quick scan uses no AI at all.
A Deep scan sends Anthropic's API the route handlers it's reviewing, the functions they call, the data models they touch, payment code (up to 15 files) and, for Supabase apps, your row-level security rules. It doesn't send the whole repo. The exact list: setrepo.com/security.
Is SetRepo accurate?
It's tested against a benchmark of hand-verified real findings and planted bugs, but like any scanner it doesn't catch everything.
Every change runs that benchmark before release: it can't lose a known true positive, and precision can't drop. Each report lists what it couldn't check. What SetRepo doesn't check is listed at setrepo.com/accuracy.
How is SetRepo different from Snyk, GitGuardian or Semgrep?
SetRepo is one scan of a whole web app, its code and its live site, with a fix prompt for each finding, aimed at people shipping apps quickly, including with AI coding tools.
In one scan it checks secrets (code and git history), vulnerable dependencies, code patterns, route-level access control, Supabase and Firebase rules, and the live site's HTTPS, headers, DNS and served JavaScript. A Deep scan adds an AI review of access control and business logic. Results come as an A–F grade and a ranked list. For what Snyk, GitGuardian and Semgrep each cover, see their own documentation: we don't describe other companies' products here.
What does a Quick scan check, and what does a Deep scan add?
A Quick scan runs every deterministic check for free; a Deep scan adds an AI review of access control and business logic.
Quick scans run SetRepo's own checks plus Gitleaks, Opengrep, Bandit, ESLint, OSV-Scanner and Trivy. The Deep scan's review also double-checks uncertain critical and high findings. Pricing: setrepo.com/pricing.
Does SetRepo test the API keys it finds?
No: SetRepo never tries, uses or validates a key it finds.
It reports where the key is and what kind it is, with the value redacted, so you can rotate it.
How do I delete my SetRepo account and data?
Open Settings in the dashboard and choose Delete account.
Confirm with your email (and password, if you have one). Your subscription is canceled first, then your projects, scans, findings and uploads are deleted, SetRepo's GitHub access is revoked, and you get a confirmation email. Settings also lets you export your data as JSON first.