Common questions before you upload
Start with the practical concerns: what to upload, who can see it, what the free score includes, and when paid review makes sense.
Upload a clean source archive for the project you want checked. Leave out dependency folders, generated build output, logs, local caches, .env files, secrets, and credentials.
Uploaded files are stored as private objects with server-generated names and automatically deleted after 7 days. The zip is not placed behind a public URL, and access is limited to the review workflow.
Yes. Scanning locally with the open-source CLI is free and unlimited, and a verified account also gets 2 free hosted scans. Either way you get every finding with its file, evidence, and fix guidance — nothing is withheld. What an issued report adds is a dated report published by us, a shareable verified page, and one re-scan.
An issued report costs $49, once — there is no subscription. The findings themselves are free: run the open-source CLI locally, or use one of your free hosted scans. What you are paying for is a report published and dated by us at the version you submitted, a shareable verified page you can hand to a third party, and one automated re-scan within 30 days. It is generated instantly and automatically with no human involvement. Automated analysis can include false positives, so it records what the scanner found rather than certifying your app.
Yes. Auth, admin routes, user data access, file uploads, secrets, abuse controls, and production settings can matter before payments exist.
We queue the analysis and send an email confirming the upload. When your automated score or issued report is ready, we email you again and point you back to My Page.
Not on the current self-serve plans. Free Security Score and the issued report are for private scoring and prioritization, not public certification.
The issued report is generated and delivered instantly on upload, so once you have used your purchase to generate a report, it is not refundable. If you have not yet used your purchase, contact us to cancel for a refund.