Connect your repository, then indicators turn into statements
Security changes less than you would expect — the decisive rules live in your database, not in your code. We only test those after the operator proof.
What we do and what we don't
- GitHub App, read-only, only the repositories you select during installation.
- Revocable at any time — in your GitHub settings, without asking us.
- We clone nothing. We fetch individual files through the GitHub API and hold them in memory only.
- We store the findings and the reference state: repository name, branch, commit.
- The access token is not stored. It is fetched from GitHub per run and expires by itself.
- No personal access token, no broad OAuth scope.
Limits
One repository, one branch. We read at most 1500 files, each up to 256 KB and 20 MB in total — that covers configuration, migrations, routes and auth paths, not your whole project. Larger or multi-part projects we agree individually.
During the repository scan we also check it from the outside, with the same free scan as on the start page. If it isn't reachable yet, the repository scan runs without outside findings.
Read-only via GitHub. We then actively check Row Level Security, interfaces and dependencies — revocable at any time.
Your Rescue offer
Don't just learn what is wrong. Get a concrete offer to fix it.
There are four routes, and the findings decide which one fits, not a package: immediate protection for open high-severity gaps, the repair plan for doing it yourselves, the repair by us, or a rebuild when the foundation does not hold.
What would you like to request?
You order the repair plan directly in the report, and a rebuild we discuss in a call. Here you request the repair or immediate protection, or write to us about another project.
Repair and stabilisation
from €1,090
net · fixed price from your scan
We implement every fix unit from your scan and stabilise what depends on it, accepted by a rescan. You see your price in the report, binding after the repository scan.
- Findings bundled into repairs, one total price
- A lower bound after the outside scan, binding after the repository scan
- Repair and stabilisation in one: architecture findings are part of it, not a second item
- Acceptance by rescan, with the same methodology as the scan
Immediate protection
€540
net · fixed price · delivered in days
Only for open high-severity security or privacy gaps. We close all open high-severity gaps from your scan. Your system is live and has an open hole — we close that first, whether you later repair or rebuild.
- Rotate access keys and remove them from shipped code
- Close row-level security rules
- Secure exposed endpoints
- If needed: temporarily disable the affected feature, with a documented way back
- We confirm scope and a date within 24 hours — or decline
Another project
free
no commitment
No scan result but a project in mind? Skip the intermediate steps and write to us directly.
- Reply within 24 hours
- Fixed price instead of an hourly rate
- Optional read-only access to your code on request
- Reply within 24 hours
- Optional read-only repo access for more depth
- Fixed price instead of an hourly rate
- Paid tiers by invoice — no automatic payment
Send request
We confirm scope and total price within 24 hours. The price always uses the current state of your scan. Submitting does not trigger a payment.