Connect a repo or upload a zip. SetRepo checks it the way an attacker would and shows you exactly what to fix.
Including Supabase, Firebase, Vercel, Next.js, React, Python, Go, Stripe, Netlify, Vue.js, Svelte, Node.js, Express, Django, Flask, FastAPI, Rust, Spring, Laravel, Ruby on Rails, PHP, GitHub, Replit, Cursor and more.
PRODUCT
Code, dependencies, secrets, database rules and the live site, checked together and ranked by what matters.
Point it at a repo or a zip, and add your live URL. Every check runs together and comes back ranked, each with a fix.
github.com/you/your-appConnect GitHub or drop a zip, then add your live URL. Code and running site are checked together, not separately.
Every issue comes with a ready prompt. Paste it into Cursor, Claude Code or Copilot and it gets fixed in place.
Secrets, access control, database rules, dependencies, API config, business logic and infrastructure.
Fix, rescan and see what changed. Unchanged code rescans free.
setrepo / your-app
Fixed · Service role key in browser code
src/lib/supabase.ts
Fixed · Admin endpoint has no auth check
app/api/admin/users/route.ts
New · Order total taken from the request
api/checkout.py
SCANS
Each scanner looks for a different way apps get broken into. They run together, and you get one ranked list with a fix for each finding.
git log --all · 6 commits
- STRIPE_SECRET_KEY="sk_live_••••••••••••"
Critical · Deleted in a later commit, but still in history. Rotate the key.
USE CASES
Find out what's exposed before your first users do.
Run a free scan and see where you stand before paying anything.
IDOR on /api/notes/:id
Anyone can read other users' notes by changing the ID.
No security jargon. Each finding says what's wrong and what to change.
A one-time deep scan includes a free rescan within 7 days.
SECURITY
Read-only access, hardened scans, and secret values redacted before anything is stored.
Confidence labels
Uncertain findings are marked 'verify', never shown as critical.
A second look by AI
On deep scans, AI review re-checks uncertain critical and high findings.
You have the final say
Mark a false positive and it's gone from your report.
You can export or delete all your data from your account at any time.
FREE CHECKS
Run a Quick scan at no cost. You get your grade and every issue we find. Unlock the exact locations and fixes when you're ready.
No credit card.
your-app · Quick scanDeep scan
1 critical · 34 high · 6 medium
CriticalService role key used in browser code
HighAdmin endpoint has no auth check
HighOrder total taken from the request
HighCORS allows any origin with credentials
BLOG
Plain-English guides to the security issues we find most, and how to fix them.
Change one number in a URL and see someone else's data. It's the most common way logged-in users read what isn't theirs.
A key in your code or git history works for whoever finds it. Deleting it later doesn't help; rotating it does.
With Row Level Security off, your public anon key can read every row. One SQL line turns it back on.
An admin endpoint that nobody linked to is still on the internet. If it doesn't check who's calling, anyone can use it.
Gluing user input into a SQL string lets that input rewrite the query. Parameterized queries stop it completely.
If the checkout reads the total from the request, the buyer decides what they pay. Prices belong on the server.
Allowing any origin with credentials lets other websites act as your signed-in users. List the origins you trust instead.
Most of your app is code you didn't write. A package with a known vulnerability is a known way in until you upgrade it.
Firebase rules, JWT verification, mass assignment, security headers and more.
All checksPRICING
Start free. Upgrade when you need the full report.
$0forever
No credit card
$4.29one-time
$6.99 for large repos
$4.29 per scan
$22.99/mo
$48.99/mo
Scans that fail are refunded automatically. Cancel anytime from your account.
One Deep scan of one project. Quick scans are free and never count. On a plan, a large repo's Deep scan uses 2 scans of your monthly allowance. A scan that fails doesn't count: whatever paid for it is refunded automatically.
When nothing changed, yes: a Deep scan of the same code as that project's last Deep scan (the same commit, or the same files in a zip) isn't run or charged, on any plan. You get that report again, and if you added a live URL its site checks run again for free. A one-time Deep scan also includes one free rescan of the same project within 7 days, to check your fixes. It covers a repo of the same size price or smaller.
Each app you scan on a plan takes a slot: 2 on Starter, 5 on Pro. You can delete a project before its first scan and its slot comes back at once. Once it's been scanned, deleting it frees the slot at your next monthly cycle. Allowances reset every month too, yearly plans included, and unused scans don't carry over. One-time Deep scans have no project limit.
Before a Deep scan runs, we size it and show you the price. Most repos are $4.29. A large one is $6.99, or 2 scans of a plan's allowance. Above that, a repo is too large for a self-serve Deep scan: contact us and we'll scan it for you. The free quick scan still works.
No. No scanner finds every vulnerability. SetRepo reduces risk but doesn't guarantee your code or site is secure, and a good grade isn't a certification. Results can include false positives and miss real issues, and the AI review is assistive and can be wrong. It isn't a substitute for a professional security audit or penetration test. Fixes and fix prompts are suggestions: you review and apply them. Details are in the Terms.
Yes, from Manage subscription on your Account page. Switching between Starter and Pro is prorated. When you cancel, your plan stays active until the end of the period you've paid for and you won't be charged again. The current period isn't refunded.