Pick a folder or drop it here…
Ready
Excluded folders
Separate several with commas or spaces. A name like deps matches that folder anywhere; a path like priv/static matches from the project root.
vendor node_modules storage bootstrap/cache public/build dist build coverage .next .nuxt .venv __pycache__ target deps _build .svelte-kit .gradle obj
Largest folders in this selection
Common:
Private scan. Excluded folders never leave your browser. The rest is sent over HTTPS to a temporary workspace, scanned, and deleted as soon as the scan finishes. Your code is never stored. Your files go to a temporary workspace only for this scan and are deleted right after it. By scanning, you agree to the Terms.
Scan log · 0 lines
Pick a project folder or file, or drag it onto this window, then press Scan.
Excluded folders never leave your browser. The rest is scanned in a temporary workspace and deleted as soon as the scan finishes. No account, no database, no stored code.
Drop a folder or files to scan
Excluded folders are skipped in your browser. Nothing is stored.
✗

What happens to my code

  1. In your browser: excluded folders (node_modules, vendor, .git, …), media and large binaries are filtered out. They never leave your machine.
  2. Your browser asks first: when you pick a folder, your browser shows its own confirmation ("View files" or "Upload files … only do this if you trust the site"). That message comes from the browser and can't be changed by websites. It's there to protect you. Prefer no prompt? Drag the folder onto the page instead.
  3. Sent over HTTPS: the remaining files are compressed and sent to the scanner for this one scan.
  4. Scanned in a temporary workspace: open-source scanners (Trivy, OSV-Scanner, Semgrep, Gitleaks, zizmor) run against it. Nothing is shared with third parties; only package names and versions are checked against public vulnerability databases.
  5. Deleted immediately: the workspace is deleted the moment the scan finishes, whether it succeeds or fails. Your summary shows the exact time.
  6. Findings expire: the results (including short code snippets around each finding) are kept for 60 minutes so you can view them, visible only to this browser, then they're gone. Secret values are masked.

No account, no database of projects. The only thing counted is the number of scans. Want nothing to leave your machine at all? Use the desktop app or CLI: same scanner, fully local.

Read the full Terms