GitHub security scanner
Scan your GitHub repository for security issues.
Choose a repository, branch and application folder, then review potential security issues in the source snapshot. Keep the evidence, fix guidance and coverage limits together in a code report.
By Vibe App Scanner · Updated
Code scanning is included with Go from $29/month and Pro from $49/month for new accounts. Free accounts do not include repository scans. Existing account and AppSumo terms are unchanged.
How to scan a GitHub repository
- Open code scanning. Sign in, confirm your plan includes repository scans and open the repository workspace.
- Connect GitHub. Follow the GitHub App installation and authorization steps. Select only repositories you are authorized to share. Request organization approval if GitHub requires it.
- Choose the scope. Select a connected repository, branch and application folder. For a monorepo, a focused folder can make coverage easier to review.
- Start the scan. Check your available allowance and submit the selected scope. Connecting an account alone does not submit a scan.
- Read the evidence and limits. Inspect affected files, supported checks, skipped files and tool statuses before proposing changes. See an authored example.
- Review, test and scan again. Give the findings to your coding tool, review the diff and negative tests, then compare a new source snapshot. Verify deployed behavior separately.
What access does VAS request?
VAS prepares a selected repository snapshot using GitHub App access tokens scoped to that repository, with contents: read and metadata: read. This source-reading flow does not need permission to push code changes.
Check the repositories selected during installation. You can change or revoke the App’s access in GitHub. An organization’s installation policy can require an owner’s approval. Never paste a GitHub personal access token into a marketing form.
Source and reports can contain sensitive material. Only connect code you are authorized to share, remove unnecessary credentials from ZIP uploads, and review the privacy policy. This page does not promise a particular retention period or model-sharing setting beyond the product’s current policy and account controls.
How this fits with GitHub’s security tools
| Workflow | Primary role | How to use it here |
|---|---|---|
| VAS code report | Review a selected source snapshot with supported checks and fix guidance. | Use the evidence and coverage notes to guide changes; combine with live-app checks when appropriate. |
| GitHub code scanning / CodeQL | Analyze repository code and surface security alerts in GitHub. | Keep it enabled when it fits your stack and plan. VAS is not a claim of complete replacement. |
| Dependabot alerts | Notify you about known vulnerable dependencies in supported ecosystems. | Review dependency alerts and update/testing workflows alongside source findings. |
| GitHub secret scanning | Find supported credential types, including across Git history and branches. | Use it for the historical exposure that a VAS source snapshot does not assess. |
Availability and features differ by repository ownership, plan and configuration. Follow the original documentation linked below rather than assuming every GitHub security feature is enabled.
Check your account’s allowance
go
$29 USD / month
10 code repository scans per month, separate from live-app scans.
pro
$49 USD / month
50 code repository scans per month, separate from live-app scans.
Subscription prices on public plan pages are for new accounts. Existing accounts keep their eligible pricing. AppSumo terms are unchanged. Check your account price.
Free accounts and AppSumo Tier 1 do not include repository scans. AppSumo Tiers 2 and 3 keep their existing access and allowances. AI review has a separate allowance; language, file, daily and execution limits apply.
Questions about code scanning
- Can VAS scan private GitHub repositories?
- Yes, with an eligible account and permission to connect the repository. You may need a GitHub organization owner to approve installation. VAS cannot access repositories you have not authorized.
- Does connecting GitHub immediately start a scan?
- No. Connection and scan submission are separate steps. Choose the repository scope and review the available allowance before starting a code scan.
- Does VAS scan all branches and Git history?
- No. A run reviews the selected source snapshot and scope. Use GitHub secret scanning or a suitable history-scanning tool for historical credentials; review the current feature availability with GitHub.
- Can I use a ZIP instead?
- Yes. Upload a source ZIP from the repository workspace without connecting GitHub. This is a one-off snapshot; file and upload limits still apply.
- What if the report shows skipped files or a failed tool?
- Treat that area as incomplete, not safe. Review the reason, narrow the application scope if appropriate and rerun when the limiting condition is resolved. The absence of findings does not verify security.
Sources and scope
Product descriptions were checked against the linked vendor guidance on October 27, 2026. Features and plan availability can change. Examples on these pages are authored illustrations, not customer findings or a comparative accuracy benchmark.