GitHub security scanning
Security scanning for your GitHub repositories
Connect a repository with a read-only GitHub App and BugSafer scans it for injection flaws, committed secrets, vulnerable and malicious dependencies, infrastructure misconfigurations and logic bugs — then gives you a transparent security score and prioritized, evidence-backed findings.
No credit card · Pay per scan
What every scan covers
Code vulnerabilities
SQL/NoSQL and command injection, XSS, unsafe eval, broken access control and insecure sessions, with taint tracking from source to sink.
Secrets & credentials
Committed API keys, tokens and private keys, reported with masked evidence — the raw secret is never stored or shown.
Vulnerable dependencies
Lockfiles checked against the OSV.dev vulnerability database, plus known-malicious packages and license policy.
Infrastructure as code
Risky defaults in Dockerfiles, Kubernetes manifests, Terraform and CI workflows such as GitHub Actions.
Malware & backdoors
Obfuscated payloads, source backdoors, committed binaries and known indicators of compromise.
Reports & exports
HTML, PDF, JSON, CSV and SBOM exports, SARIF for GitHub code scanning, and OWASP Top 10 / compliance rollups.
How it works
- 1
Install the BugSafer GitHub App and choose which repositories it can read.
- 2
Start a scan — or schedule one daily, weekly or monthly.
- 3
Your code is shallow-cloned into an isolated sandbox, analyzed without being executed, and the workspace is destroyed afterwards.
- 4
Review prioritized findings with file, line and fix guidance, and get emailed when new critical issues appear.
Frequently asked questions
What access does BugSafer need to my GitHub account?
BugSafer uses a GitHub App with read-only access to the repositories you select. Each scan uses a short-lived token limited to the one repository being scanned.
Does BugSafer run my code?
No. Code is analyzed statically in an isolated sandbox — nothing is executed, git hooks are disabled, and the workspace is deleted when the scan finishes.
Which languages are supported?
JavaScript/TypeScript, Python, Java, Go, C#, Ruby and PHP, plus Docker, Kubernetes, Terraform and CI configuration.
Can I scan private repositories?
Yes. Private repositories are cloned with a short-lived, repository-scoped GitHub App token that is never stored.
Scan your first repository free
Connect GitHub and get a security score with prioritized findings in minutes. 2 free credits, no credit card.