Catch it before it merges.
Automated, security-scoped review on every pull request — secrets, injection, auth/session changes, and dependency CVEs, posted directly as PR comments. Install the GitHub App, no CI config to write.
Security-scoped, not general code quality.
Code doesn't try to be a linter or a style bot — plenty of tools already do that well. Every check exists to catch something that becomes an incident if it ships, and every finding is posted where your team already works: as a comment on the pull request.
API keys, tokens, and connection strings that made it into a diff before anyone noticed — the single most common way a breach starts.
SQL, command, and template injection patterns introduced by new or changed code paths, flagged with the specific line and why it's exploitable.
Modifications to authentication, authorization, or session handling get closer scrutiny — this is where a one-line change quietly becomes a privilege escalation bug.
New or updated packages checked against known vulnerabilities before they land in your default branch, not discovered weeks later in a scheduled audit.
Install the app, pick your repos, done.
Connect via the GitHub App and choose which repositories get security review — the same ownership model Detect uses for domains, applied to repos instead. No pipeline to configure, no YAML to maintain unless you want to tune it.
Every pull request against a connected repo triggers a review scoped to what actually changed, not the whole codebase. Findings post as inline PR comments with severity, why it matters, and how to fix it — the same review categories every time, so nothing depends on who happened to be the human reviewer that day.
Buy it alone, or bundle with Detect.
Code is billed monthly, flat per organization for up to 5 users — not metered per seat, not per PR.
Automated security review on every pull request across your connected repos. Up to 5 users included.
Both products together — save $6/mo over buying Code and Detect separately.