Example scan — sample repo

acme/ai-content-platform

AI-powered content generation platform with multi-model support, team workspaces, and usage-based billing

OWASP Top 10 security baseline

3 critical, 5 warnings

SQL InjectionA03:2021String interpolation in query (lib/db.ts, api/analytics.ts)

Hardcoded API KeysA02:2021OpenAI key found in lib/ai-client.ts

SSRF via User Input in FetchA10:2021User-controlled URL in api/proxy/route.ts

eval() UsageA03:2021eval() in prompt builder (lib/prompt-engine.ts)

Rate LimitingA04:2021No rate limiting on API routes

Security HeadersA05:2021No Helmet or CSP headers found

JWT Weak AlgorithmA07:2021jwt.sign() without explicit RS256/ES256

Sensitive Data in LogsA09:2021console.log with apiKey (lib/billing.ts)

Secret ScanningA02:2021No additional hard-coded secrets

AuthenticationA07:2021Auth.js middleware detected

Input ValidationA04:2021Zod schema validation detected

CSRF ProtectionA04:2021SameSite cookie patterns detected

HTTPS ConfigurationA05:2021HTTPS references found in config

Lock File PresentA08:2021pnpm-lock.yaml present

Password HashingA02:2021bcrypt detected in auth flow

Deprecated DependenciesA06:2021No known deprecated packages

TLS ValidationA02:2021rejectUnauthorized not disabled

Container SecurityA05:2021Dockerfile uses non-root user

Sign in to scan your repo

The left panel is sample data. Sign in with GitHub to scan your repositories for security vulnerabilities, secrets, and code quality issues.