Free
Free repo and app health scan.
Point us at the repository. We run the same first-pass checks the paid audit starts with and send you the findings. No call, no invoice, no obligation.
- Price
- Free
- Turnaround
- 2 working days
- You get
- A written findings summary by severity
- Your code
- Deleted within 7 days
What it checks
Five categories, named specifically
Specificity is what makes a free tool credible. A scan that promises to check everything is checking nothing.
Security
Exposed secrets, dependency vulnerabilities with a known exploit path, authentication and permission gaps, and anything writing sensitive data somewhere it should not.
Dependency risk
Unmaintained packages, versions pinned so far back that upgrading is now a project, and licences that will fail an enterprise procurement review.
Architecture
Coupling, the shape of the data model, and whether the seams between subsystems are consistent — the specific place AI-generated code tends to come apart.
Scalability
Queries that will not survive a hundred times the rows, missing indexes, N+1 patterns, and work being done in a request that should be in a queue.
Running cost
Where the money goes at your current volume and what happens to that number at ten times the traffic. Usually one endpoint or one query.
Who it is for
You, if any of this is true
- You built on Lovable, v0, Bolt, Base44, Cursor or Claude and are now stuck.
- You inherited a codebase and want a second opinion before committing to it.
- You are about to raise and would rather find the problems before diligence does.
- You are scaling and something is getting slower in a way nobody has diagnosed.
Sample
What the output looks like
{{TODO: SAMPLE_REPORT}} — a redacted example scan output — this is the highest-value missing asset on the page
Privacy
What happens to your code
This is the real objection to sending anyone your repository, so it gets a section rather than a line in the FAQ.
- Access
- Read-only. We never commit, never open a pull request.
- Storage
- Cloned to an encrypted machine, never a shared drive.
- Retention
- Deleted within 7 days of the report being sent.
- Training
- Never used to train anything, by us or anyone else.
- Sharing
- Never shared, quoted or used as an example without written permission.
- NDA
- Available before you send anything. Ask and we sign it same day.
FAQ
Questions people actually ask
Why is it free? What is the catch?
It is the top of our funnel and we are not pretending otherwise. Some people who get a scan book the paid audit. Most do not, and that is fine — the scan is cheap for us to run because it is largely automated.
Is this just a tool running lint?
The first pass is automated. A person reads the output before it is sent, which is why it takes two days rather than two minutes, and why the summary says what the findings mean rather than listing rule violations.
What if the repo is private?
Most are. Add us as a read-only collaborator, or send an archive. We will sign an NDA first if you want one.
How is this different from the paid audit?
The scan is automated checks plus a human summary, across two days. The audit is ten days of a senior engineer reading the code, reproducing your specific failures, and producing a prioritised roadmap with effort estimates. The scan tells you whether something is wrong; the audit tells you what to do about it.
Start
Send us the repo
Repository URL, an email to send the findings to, and one question about where you are.
{{TODO: SCAN_FORM}} — the form needs a backend before it exists as a form — an inbox that receives repo URLs and a queue that runs the checks. Section 19 of the spec says this funnel needs its own technical spec first, and it does.
Until that lands, the manual route works and is monitored:
Send it to us directly