Code security scanner
Code security scanning for the app you ship.
Connect GitHub or upload a ZIP to review potential vulnerabilities in your source code. Inspect the affected files, evidence and fix guidance, then review and test changes with your coding tool.
By Vibe App Scanner · Updated
Code scanning is included with Go from $29/month and Pro from $49/month for new accounts. Free accounts do not include repository scans. Existing account and AppSumo terms are unchanged.
A finding you can investigate
Locate it
See the source file, line and evidence behind a potential issue. Check the caller, resource and intended access.
Review the change
Bring the finding to your coding tool. Ask for a proposed diff and tests that preserve legitimate access.
Check again
Review the new source snapshot after changing the code. Check coverage and use runtime tests where needed.
Explore a fictional code report showing an ownership issue, a safer pattern and what remains unverified.
What a source scan can review
| Area | What to review | Important boundary |
|---|---|---|
| Credentials | Potential secrets and privileged configuration in selected source files. | A public client key is not automatically a secret. Git history and actual deployed exposure require separate checks. |
| Input and sensitive operations | Supported routes, handlers, inputs and sinks, including bounded helper tracing. | Unresolved imports, dynamic behavior and unsupported framework patterns can leave paths unassessed. |
| Access and ownership | Supported source patterns around caller identity, resources, policies and privileges. | Source evidence does not prove complete authorization or the effective policy in a hosted database. |
| Dependencies and tools | Supported manifests/lockfiles and enabled external checks, with individual statuses. | Tool errors, unsupported formats and incomplete coverage must not be read as a clean result. |
Start with the source you want reviewed
Connect GitHub
Select a repository you are authorized to review, then choose the branch and application folder. VAS uses scoped read access to prepare a source snapshot.
Upload a ZIP
Review a one-off source snapshot without a GitHub connection. Include the relevant code, configuration and lockfiles. Leave out node_modules, build output, Git history and unnecessary credentials. Your account shows the upload limit before you submit.
Code scanning and live-app scanning answer different questions
| Input | Useful for | Does not establish |
|---|---|---|
| Source snapshot | Reviewing supported code paths, committed policies and configuration before or after deployment. | Whether the same commit is deployed, all runtime behavior or all historical credential exposure. |
| Live-app URL | Observing reachable pages, bundles and endpoints, including exposed data and browser protections. | Full private source, every protected route or complete permissions across all roles. |
Use both where appropriate. Read the SAST and DAST comparison and the live-app sample report for the other side of the workflow.
Included in Go and Pro
go
$29 USD / month
10 code repository scans per month, separate from live-app scans.
pro
$49 USD / month
50 code repository scans per month, separate from live-app scans.
Subscription prices on public plan pages are for new accounts. Existing accounts keep their eligible pricing. AppSumo terms are unchanged. Check your account price.
Free accounts and AppSumo Tier 1 do not include repository scans. AppSumo Tiers 2 and 3 keep their existing access and allowances. AI review has a separate allowance; language, file, daily and execution limits apply.
Questions about code scanning
- Can I scan a private repository?
- Yes, when your account has code-scanning access and you can authorize the GitHub App for the repository. You can also upload a source ZIP without connecting GitHub. Organization approval may be required.
- Is repository scanning free?
- No. Code scanning is included with eligible paid plans. The free live-app preview is a different feature. New-account Go includes 10 repository scans per month; Pro includes 50. AI review has a separate allowance.
- Which languages and frameworks are supported?
- Coverage varies by language, framework, selected files and available tools. Supported JavaScript/TypeScript handlers receive bounded source-flow checks; other languages and tools have different coverage. Read the tool statuses, skipped files and limitations in each report rather than assuming every file was fully assessed.
- Does a clean code scan mean my app is secure?
- No. A scan can miss issues or leave context unresolved. Source checks do not establish deployed configuration, complete runtime behavior or every user-role permission. Combine code review, tests and authorized live-app checks.
- Will VAS change my code?
- No. VAS provides findings and guidance. Review proposed changes in your coding tool, run appropriate tests, deploy the approved change and scan again. A finding that disappears is not by itself proof of a fix.