Terms of Service

These terms cover your use of SetRepo, the website and the scanning service at setrepo.com. By creating an account or running a scan, you agree to them.

The service

SetRepo checks your code, its dependencies, its configuration and, if you add one, your live site for security problems, and tells you how to fix what it finds.

• Quick scans run our automated checks. Your first scans are free, within daily and monthly limits. A free quick-scan report shows the grade, the counts and every finding's title and severity, with full details for a few of them.
• Deep scans add an AI review of your code and show every finding in full. You pay for each deep scan at the price shown before checkout, or use a scan from your subscription. A paid deep scan includes one free rescan of the same project within 7 days.
• Subscriptions (Starter and Pro) include a number of scans each monthly cycle. Unused scans don't carry over.

What you may scan

Only scan code and websites you own or have permission to test. In particular:

• Connect only repositories you're allowed to give us access to. Our GitHub App only reads code; it never changes it.
• Checks that send a website more than a normal page load only run on domains you've verified you control, and we re-check that before every scan. Don't try to get around this.
• Don't use SetRepo to attack, overload or probe systems that aren't yours, and don't try to get around our usage limits (for example, with multiple accounts).

We may suspend or close an account that breaks these rules. If we do, we cancel any subscription.

Your code and reports

Your code stays yours. You let us process it only to run the scans you ask for. We delete our copy when each scan ends (a quick-scan zip within 24 hours), as described in the Privacy Policy. Your reports are yours too. You can download them or delete them, along with your account, at any time.

Results, and no guarantee

No scanner finds every vulnerability, and SetRepo is no exception. SetRepo reduces risk; it does not guarantee that your code, your app or your site is secure or free of vulnerabilities.

• Results can be wrong both ways. A report can include problems that aren't real (false positives) and can miss problems that are (false negatives).
• The AI review is assistive. It can be wrong, which is why every finding shows how confident we are. Check a finding before you rely on it.
• A grade is not a certification. A good grade, or a clean report, means our checks didn't find a problem. It doesn't mean there isn't one, and it isn't a security certification, attestation or audit opinion you can give to anyone else.
• It's not a substitute for a professional audit. SetRepo doesn't replace a security audit or penetration test by qualified people.
• Fixes are yours to make. Fixes and fix prompts are suggestions. You're responsible for reviewing them, testing them and deciding whether to apply them.

Payments and refunds

Payments are processed by Stripe. Subscriptions renew automatically until you cancel them from Manage subscription; your plan then stays active until the end of the paid period. Our Refund Policy explains when you get money back, including the automatic refunds for scans that fail on our side.

Liability

SetRepo is provided "as is" and "as available", without warranties of any kind, including that it will find every issue or that its results are accurate or complete. To the extent the law allows, we aren't liable for indirect or consequential losses, or for losses caused by a security issue SetRepo didn't report, and our total liability for any claim is limited to the amount you paid us in the 12 months before it.

Changes and contact

We may update these terms. If we do, we'll update this page and the date at the top. Questions: support@setrepo.com.