Guides

Quick vs Deep scans

Last updated

SetRepo runs two kinds of scan. Both look at the same code; a Deep scan adds an AI review on top. No code to share? You can also scan just the live site (below).

Quick scan

  • Free, and it never counts toward a plan's allowance.
  • Runs every deterministic check: secrets in code and git history, vulnerable dependencies, injection patterns, CORS, auth and token handling, database rules (like Supabase RLS), infrastructure and, when you add your URL, the live site.
  • On the Free plan the report is partly hidden: you see the grade, the counts and every finding's title and severity, plus full details for a few top findings. On a paid plan Quick scans are fully unlocked.

Deep scan

  • Everything in a Quick scan, plus the AI review of access control (IDOR, who can read or change which records) and business logic (prices, quotas, state changes the client shouldn't control).
  • The full report: file, line, exploit and fix for every finding, the copy-paste fix prompts and the PDF.
  • Before it runs, SetRepo sizes the repo and shows the price: most repos are a standard scan, a large one costs more, and on a plan it uses 2 scans of your monthly allowance.

Rescans

  • A Deep scan of unchanged code (the same commit, or the same files in a zip) isn't run or charged on any plan: you get the earlier report again, and the live-site checks run again for free.
  • A one-time Deep scan includes one free rescan of the same project within 7 days, to check your fixes.
  • A paid Deep scan that fails on our side earns a free rescan of the same project, added automatically. If the AI review can't finish, you keep the Quick report and get the same free rescan. On a plan, the scan goes back into your allowance.

Live site only

  • For a site whose code you can't or don't want to share. Free, like a Quick scan, and it starts as soon as the site answers.
  • Checks what anyone can see from outside: HTTPS and your certificate, security headers, cookies, DNS and email records (SPF, DKIM, DMARC), and the JavaScript your site serves: keys that shouldn't be public, Supabase or Firebase keys, and source maps.
  • Verify the domain to unlock the deeper checks: exposed files (.env, .git, backups, database dumps) and whether your Supabase or Firebase data can be read without signing in.
  • Not checked without the code: API routes and who can call them, sign-in, database rules, secrets in the repo, dependencies and the AI review. The grade covers only what was checked, and the report says so.
  • Add the code to the project later (the report's Add your code for the full scan) and it becomes a normal project: same name, live URL and history.
  • Each site can be scanned once every 10 minutes.

Which to run

Run a Quick scan on every change, it costs nothing. Run a Deep scan before a launch, after changing who can see what, or when the Quick report is clean and you want the review that only the AI pass can do.