visitor@blackz:~/scan — bash — 118×42

████  █      ███   ████ █   █ █████
█   █ █     █   █ █     █  █     █
████  █     █████ █     ███     █
█   █ █     █   █ █     █  █   █
████  █████ █   █  ████ █   █ █████  ████ ████   ███   ████ █   █
█     █   █ █   █ █     █  █
█     ████  █████ █     ███
█     █  █  █   █ █     █  █
 ████ █   █ █   █  ████ █   █ █████ █████ █   █ ████  █████ ████
█       █   ██  █ █   █ █     █   █
███     █   █ █ █ █   █ ███   ████
█       █   █  ██ █   █ █     █  █
█     █████ █   █ ████  █████ █   █

// scan any repo // find real issues█

● READY — critical — high — medium secrets: —

initializing...

how this actually works

You pick a real source — paste code directly, upload files from your computer, or type any public GitHub repo (owner/repo or a full URL).
Nothing is pre-written. For a GitHub repo, this page asks GitHub's own public API (api.github.com) for the real file list, then downloads each file's actual text straight from raw.githubusercontent.com — the same bytes anyone sees on github.com. For paste/upload, it reads exactly what you gave it.
The same ~13 rules run on every scan, every time — hardcoded secrets, CORS wildcards, SQL/shell injection, XSS sinks, weak crypto, and more. No rule is written "about" any specific repo; every rule is generic pattern-matching applied fresh to whatever you just gave it.
Every result shows its receipts — the exact file, line number, and matched snippet, so you can go check it yourself in the real source. If a card doesn't show a real file:line, it isn't from a live scan. The network trace panel above prints the literal URL, HTTP status, timing, and the first bytes of GitHub's actual response, so you can watch the data arrive instead of trusting a summary.
Nothing is stored on a server, because there is no server. Your last scan is kept only in localStorage — on your own machine, in this browser — for 24 hours, purely so a refresh doesn't lose your results. It never syncs anywhere, and you can wipe it any time with the Clear cached scan button.

scan a target

▶ GitHub repo

▶ Paste code

▶ Upload files

Runs entirely in your browser — nothing is uploaded anywhere. Public repos are read via api.github.com (file tree) and raw.githubusercontent.com (file contents), same as any browser could. Scans every source file in the repo — no file cap. Individual files over 250KB are skipped (they're almost always vendored bundles or data, not code you wrote). This is a pattern-based heuristic scanner (regex rules for secrets, CORS, injection, XSS, weak crypto, etc.) — good for a fast first pass, not a replacement for CodeQL/Semgrep on anything you'd ship.

idle 0.00s

network trace — the literal requests this page made

No requests yet. GitHub scans appear here with the exact URL, HTTP status, timing, and the first bytes of the real response. Paste/upload scans make zero requests — nothing to show, by design.

results at a glance

Severity distribution

Findings by category

detailed issues — click to expand

suggested fix order

legend — new to this? start here

SEVERITY

Critical — actively exploitable right now (e.g. a real secret key, an open CORS wildcard). Fix before doing anything else.
High — a serious bug or vulnerability (e.g. SQL/shell injection). Fix soon, before shipping.
Medium — a real issue, but lower urgency (e.g. debug mode left on).
Low / Info — worth knowing, rarely urgent on its own (e.g. weak hash used somewhere non-critical).