Catch it before it merges.
Automated, security-scoped review on every pull request — secrets, injection, auth/session changes, and dependency CVEs, posted directly as PR comments. Install the GitHub App, no CI config to write.
Security-scoped, not general code quality.
Code doesn't try to be a linter or a style bot — plenty of tools already do that well. Every check exists to catch something that becomes an incident if it ships, and every finding is posted where your team already works: as a comment on the pull request.
API keys, tokens, and connection strings that made it into a diff before anyone noticed — the single most common way a breach starts.
SQL, command, and template injection patterns introduced by new or changed code paths, flagged with the specific line and why it's exploitable.
Modifications to authentication, authorization, or session handling get closer scrutiny — this is where a one-line change quietly becomes a privilege escalation bug.
New or updated packages checked against known vulnerabilities before they land in your default branch, not discovered weeks later in a scheduled audit.
Install the app, pick your repos, done.
Connect via the GitHub App and choose which repositories get security review — the same ownership model Detect uses for domains, applied to repos instead. No pipeline to configure, no YAML to maintain unless you want to tune it.
Every pull request against a connected repo triggers a review scoped to what actually changed, not the whole codebase. Findings post as inline PR comments with severity, why it matters, and how to fix it — the same review categories every time, so nothing depends on who happened to be the human reviewer that day.
Buy it alone, or bundle with Detect.
Code is billed by review volume, since usage scales with how much code you ship, not with headcount. It's available standalone or bundled with Detect at a discount — full numbers and plan details live on the pricing page.