Pick a folder or drop it here…
Ready
Exclude vendor node_modules storage bootstrap/cache public/build dist build coverage .next .nuxt .venv __pycache__ target
Private scan. Excluded folders never leave your browser. The rest is sent over HTTPS to a temporary workspace, scanned, and deleted as soon as the scan finishes. Your code is never stored. Your files go to a temporary workspace only for this scan and are deleted right after it. By scanning, you agree to the Terms.
Scan log · 0 lines
Pick a project folder or file, or drag it onto this window, then press Scan.
Excluded folders never leave your browser. The rest is scanned in a temporary workspace and deleted as soon as the scan finishes. No account, no database, no stored code.
Drop a folder or files to scan
Excluded folders are skipped in your browser. Nothing is stored.
✗

What happens to my code

  1. In your browser: excluded folders (node_modules, vendor, .git, …), media and large binaries are filtered out. They never leave your machine.
  2. Sent over HTTPS: the remaining files are compressed and sent to the scanner for this one scan.
  3. Scanned in a temporary workspace: open-source scanners (Trivy, Semgrep, Gitleaks) run against it. Nothing is shared with third parties; only package names and versions are checked against public vulnerability databases.
  4. Deleted immediately: the workspace is deleted the moment the scan finishes, whether it succeeds or fails. Your summary shows the exact time.
  5. Findings expire: the results (including short code snippets around each finding) are kept for 60 minutes so you can view them, visible only to this browser, then they're gone. Secret values are masked.

No account, no database of projects. The only thing counted is the number of scans. Want nothing to leave your machine at all? Use the desktop app or CLI: same scanner, fully local.

Read the full Terms