ScanMySaaS
Read-only public and private repository scan

GitHub repo scanner for vibe-coded apps.

Check a public or private repository for the mistakes AI coding agents cannot see after deployment: committed secrets, unsafe workflows, exposed client keys, missing database boundaries, and risky code patterns.

We never execute repository code Secret values stay out of the report

Scan a public GitHub repository

Free, no account needed. Sign in to save reports.

Reads up to 60 security-relevant files from one pinned commit, highest-risk first. It does not search full Git history.

scanmysaas.com/repo-scan/…Sample report
Repository report showing score, scan coverage and two findings with package-lock.json line references; private repository identity is outside the crop.
Findings point to the file and line. Real report excerpt; private repository identity omitted.
scanmysaas.com/repo-scan/…Sample report
A running scan of Streamentor/securitybusiness with seven stages, AI logic review active and the message You can leave this page.
Runs in the background. You can leave the page.

What the repo scan checks

The mistakes hidden behind a working demo.

Secrets and credentials

Committed .env files, private keys, provider tokens, database URLs, and secret-like literals.

GitHub Actions

Broad token permissions, mutable action tags, secret output, and dangerous pull_request_target flows.

Client exposure

Public environment secrets, raw HTML sinks, dynamic code execution, wildcard CORS, and source maps.

Database boundaries

Supabase service-role exposure and SQL migrations that create tables without visible RLS enablement.

Known vulnerable dependencies

Exact versions from npm, Python, Go, and Rust lock data checked against the OSV advisory database.

Codex, Claude, Cursor, and MCP

Agent permissions, remote MCP transport, unpinned tool packages, destructive commands, and secret-transfer paths.

Two scans, two surfaces

Scan the repository before launch. Scan the public app after launch.

Repository checks catch secrets and configuration mistakes. The website scanner checks the deployed headers, TLS, cookies, files, routes, and browser-facing behavior.

Two views of your app

Website scan sees

  • TLS and HTTPS
  • Headers and cookies
  • Exposed files and source maps
  • CORS responses
your app

Repo scan sees

  • Committed secrets / public env vars
  • RLS signals in migrations
  • GitHub Actions and dependencies
  • Selected routes: paid AI review

Website scans inspect public TLS, headers, cookies, files, source maps and CORS. Repository scans inspect committed secrets, migration RLS signals, Actions, public environment variables and dependencies. Paid AI review inspects selected routes; neither view proves security.

Open website scanner

How to scan a GitHub repository

Scan a repo in three steps.

  1. 01

    Paste a repository or connect GitHub

    Paste a public github.com URL, including a /tree/branch link, or connect the read-only ScanMySaaS GitHub App and pick a private repository.

  2. 02

    We read one exact commit

    The branch is resolved to a commit SHA and up to 60 security-relevant files are read from it, highest-risk first: middleware, API routes, auth, payments, configs and workflows.

  3. 03

    Get findings with file and line

    Each finding names the file and line, explains why it was flagged and comes with a fix prompt for Cursor, Claude or Codex. Rescan after fixing to confirm.

Read-only repository access

Your GitHub App grants contents: read and metadata: read for selected repositories. The scanner resolves one pinned commit and reads up to 60 highest-risk files in memory to produce a report. It never clones, installs or runs code.

Never clones, installs or runs your code. Selected source files are read in memory; paid AI review has its own disclosed processing limits.

Repo scanner FAQ

Questions about scanning your repository.

What does the GitHub repo scanner check?+

It looks for committed .env files and private keys, API keys and tokens in code, risky GitHub Actions (broad permissions, unpinned actions, pull_request_target), client-side secret exposure, unsafe code sinks, Supabase service-role exposure and tables without row level security, coding-agent and MCP configuration risks, and exact dependency versions with known vulnerabilities in the OSV database. On Starter and Pro an AI review also reads the riskiest files for authorization and business-logic gaps.

How do I scan a GitHub repository for secrets and vulnerabilities?+

Paste the repository URL into the repo scanner and confirm you own it or have permission. For a private repository, sign in, connect GitHub with the read-only ScanMySaaS GitHub App and choose the repository. The scan reads one pinned commit and returns findings with file paths and line numbers, usually within a minute.

Is the repo scanner free?+

Public repository scans are free. Private repository scans and the AI logic review are included in the Starter and Pro plans.

Can I scan a private GitHub repository?+

Yes. Install the ScanMySaaS GitHub App on the repositories you choose. It can only read repository contents and metadata and cannot write to your code. Files are read in memory during the scan and discarded; only the report is saved, privately to your account. You can revoke access on GitHub at any time.

Does the scanner clone my repository or run my code?+

No. It does not clone the repository, install packages, run builds or execute code. It reads a bounded set of text files from one commit through the GitHub API, and secret values never appear in the report.

How is this different from GitHub secret scanning or Dependabot?+

GitHub's tools focus on known secret formats and dependency alerts. The ScanMySaaS repo scanner adds checks aimed at apps built with AI coding agents (Supabase RLS, client-exposed keys, risky workflows, agent and MCP configs, missing authorization logic) and pairs the code scan with a scan of your live website. Keep GitHub's protections enabled as well.

Shipping with AI tools? Read the vibe coding security guide, or run the free website vulnerability scanner on your live app.