FROM REPOSITORY TO REVIEWABLE FINDINGS
GitHub security scanner: find code risks before you ship
SetRepo is a GitHub security scanner for developers shipping AI-built apps. Check supplied code for exposed secrets, known vulnerable dependencies and risky patterns, then review the evidence and fix confirmed issues in your own workflow.
Sign in to continue. Public repositories work by URL; private repositories use the GitHub App with read-only access.
What does this repo security scanner check?
A useful code security scanner connects each finding to evidence you can inspect. SetRepo combines source checks; coverage depends on the files, language, framework and scan mode.
- Secrets and exposed API keys
- The secret scanner looks for supported credential patterns in supplied code. Investigate whether a value is a private secret, a public client identifier or a test fixture.
- Known vulnerable dependencies
- Dependency checks compare supported package information with vulnerability advisories. Confirm the affected version and assess the upgrade in your application.
- Risky code and configuration
- Static checks look for supported unsafe patterns and configuration, including source-level access-control concerns. Results need review in the context of middleware and deployment settings.
- Selected access and business logic
- Paid Deep scans add AI review of selected code for issues such as IDOR and client-trusted values. This review does not execute your application or test every workflow.
How do I scan a GitHub repo for vulnerabilities?
Choose the repository
Paste a public GitHub URL or connect the GitHub App for selected private repositories. You control which repositories the app can read.
Review setup and run
Confirm your project and choose Quick or paid Deep. Check the current credits or price before authorizing the scan.
Verify, fix and rescan
Read the evidence and coverage notes. Apply changes in your editor, test affected behavior and rescan the updated code.
Need a security scan for AI apps?
Code written with Cursor, Claude or another assistant still needs checks at the boundaries: which values reach the browser, who can call each route, and whether database rules enforce ownership.
For an app using Supabase, inspect RLS policies and keep privileged keys on the server. Add a separate live site scan to review public responses and JavaScript; a repository alone does not show every production setting.
Start with the highest-impact evidence
- Review reported private credentials and their permissions.
- Trace authentication and object ownership on sensitive routes.
- Check database policies supplied with the code.
- Test authorization with separate user accounts after fixing.
What should 2027's best security scanner help you do?
If you are choosing a scanner for 2027, start with a practical checklist: relevant coverage for your stack, evidence you can verify, clear access permissions and a repeatable fix-and-rescan workflow.
Use SetRepo against a repository you know, inspect what it checks and skips, and judge the findings against your application. Compare the results with your release checklist and the manual tests your team needs to run.
GitHub security scanner questions
Can I scan a private GitHub repository?
Yes. Connect the SetRepo GitHub App and select the private repositories it can read. Repository access is read-only. Organization repositories may require an owner to approve the installation.
Does SetRepo change my code automatically?
No. Review the findings and available fix guidance, make changes in your own development workflow, and rescan. SetRepo does not need repository write access to produce a report.
Is a Quick scan the same as an AI code security scan?
Quick scans use deterministic checks for secrets, known vulnerable dependencies and supported code patterns. A paid Deep scan adds AI review of selected code for access-control and business-logic issues. Review current pricing and coverage before starting.
Does a clean scan mean my repository is secure?
No. Results apply to the code and checks that were analyzed. Review skipped checks and coverage notes, test permissions with separate accounts, and assess production configuration outside the repository.