Catch leaked keys and risky code
before you ship
Connect GitHub or Bitbucket, or run the CLI on your machine. Repo Scanner finds hardcoded secrets, vulnerable dependencies, unsafe code and risky AI-agent settings, then writes the fix and can open the pull request.
Fair · Repo Health
Quality Gate: FAILED1
Secrets
4
SAST
2
Dep CVEs
Repo Scanner is one of six Scanverra tools. One subscription covers all of them.
See all six toolsWhat we analyze
Dependencies, vulnerabilities, and code quality, all in one pass.
SAST & secrets detection
Static analysis for JS, TS, and Python, covering SSRF, NoSQL injection, open redirect, template injection, sandbox escapes, insecure deserialization, and secret patterns including entropy-based detection.
Dependency CVE scanning
Lockfiles and manifests for npm, Python, Go, Ruby, PHP, Rust, Java, .NET and Dart checked against maintained vulnerability databases. CVEs graded by severity with the exact fix version, plus outdated package detection showing the latest available version.
IaC & config security
Dockerfile, docker-compose, Kubernetes (security contexts, capabilities, ConfigMap secrets), and GitHub Actions: pinned actions, write-all permissions, and script injection all checked.
AI fixes & PR creation
Every finding comes with an AI-written fix. Select the ones you want and Scanverra opens a pull request on GitHub: title, body, and diff pre-filled. Suppress false positives with inline comments.
A secret scanning tool, built into every scan
Every repo scan includes secret scanning: provider-specific patterns for cloud, payment, messaging and AI API keys plus high-entropy strings, so a leaked key is caught alongside SAST, dependency and IaC findings. It scans the current files of the branch; rotate any key it finds before you remove it.
Prefer the command line?
@scanverra/cli scans your code on your own machine, no GitHub or Bitbucket connection needed. Only the findings are sent to Scanverra.
Learn more about the CLInpx @scanverra/cli scan .How it works
From scan to merged PR, without leaving the browser.
Connect GitHub or Bitbucket
OAuth in one click: we request only the permissions needed to read your code and optionally open pull requests on GitHub.
Select a repo and branch
Choose any repo from the list. Pick the branch to scan, defaults to your repo's default branch.
Review findings by category
Security, Quality, IaC, Dependencies, and Analysis tabs break down every finding with severity, file path, and line number.
Apply fixes and create a PR
Accept AI-suggested fixes, tweak the code if needed, then open a pull request on GitHub with one click.
Full check list
Comprehensive signals across SAST, secrets, dependencies, IaC, and code quality.
Pairs well with
Each Scanverra tool covers one angle. These two cover the next ones.
One subscription
All six tools on one plan
- Free: 5 Repo Scanner scans a month, no card.
- Pro: unlimited Repo Scanner scans, plus unlimited scans on the other five tools. Billed monthly, cancel anytime.
Related reading
Automating Code Quality and Dependency Audits in CI/CD
How to catch vulnerable dependencies, license issues, and quality drift on every pull request instead of during a quarterly cleanup.
npm audit vs. Snyk vs. Dependabot: Choosing the Right Dependency Scanner
Three names that come up constantly, doing genuinely different jobs - and why most teams end up using more than one, not choosing just one.
Understanding CVSS Scores: How to Prioritize Vulnerability Fixes
A 9.8 and a 7.5 aren't just "high" and "medium" - what actually goes into a CVSS score, and why the number alone shouldn't decide what you patch first.
Website Audit
Performance, SEO & accessibility
Security Scanner
Headers, secrets, SSL & CSRF risk
Browser Audit
Broken links, JS errors & forms
Scan, fix, and ship, in minutes
Connect your repo, review every finding, and open a PR only when you say so.