Repository scanning
Everything your repository ships, checked before it does.
A local path on the server, or a public GitHub repo cloned just for the scan — analyzed for dependency risk, secrets, container misconfiguration, risky code patterns, and LLM-usage risk in one pass.
$ security-monitor scan-repo . Resolving dependencies… npm 4 advisories (1 high) pip 0 advisories Scanning for secrets… ok Checking Dockerfile… 1 finding (medium) SAST pass… 2 findings (low) Score: 76/100
Every layer of the repository, one scan
Dependency vulnerabilities
Known-vulnerable packages resolved across 8 package ecosystems via OSV.dev, the same open vulnerability database used across the industry.
Secrets detection
Hard-coded credentials, tokens, and keys caught in source before they ship — not just at the commit-hook stage.
Dockerfile & Kubernetes
Common container and manifest misconfigurations — permissive defaults, missing resource limits, exposed ports.
Pattern-based SAST
Rule-based static analysis surfaces risky code patterns without needing a full build or execution environment.
LLM usage risk
Flags patterns associated with unsafe LLM integration — unvalidated prompt construction, unbounded tool access.
CI/CD gating
The bundled CLI fails a pipeline when the score drops below a threshold you set — same engine as the web app.
SBOM export
A software bill of materials generated per repository scan, for supply-chain record-keeping.
In-toto attestations
Evidence that a scan ran against a given commit — not a SLSA build-provenance claim, but a real record.
Keep reading
Where most people go next
Try it on a real repository
Free to start, and reading your first repository in minutes.