Scan

Who Scan is for

For developers before a commit, and for anyone reviewing code they inherited. The API key hardcoded in a config file two years ago is still there, and it is still valid.

What Scan does

Deterministic pattern matching does the secret detection, because API keys and tokens have recognisable shapes and a model is the wrong instrument for a job that regular expressions do reliably. The AI assists only on logic vulnerabilities, where pattern matching genuinely cannot help. Detected secrets are always masked and never returned in full — a scanner that displayed the key it found would be creating the exposure it exists to prevent, and nothing sensitive is stored or transmitted.

• →Secret detection with masked output
• →Vulnerability pattern matching
• →Optional AI logic-flaw assist
• →Nothing sensitive stored or transmitted

How Scan works

1. 01

   Paste the code

   A file, a diff, a configuration block.

2. 02

   Run the deterministic detection

   Secrets have recognisable shapes, and pattern matching finds them reliably where a model would not.

3. 03

   Add the AI logic pass

   Only for logic vulnerabilities, where structural patterns cannot help.

4. 04

   Rotate anything it finds

   A secret that reached source control is compromised. Removing the line is not the fix; rotating the key is.

What Scan does not do

Scan reviews what you paste — no repository scanning, no git history, no CI integration — so a secret committed and later deleted is still in your history and will not be found here. Pattern matching finds known shapes and misses novel ones; the AI logic pass produces both false positives and false negatives. It is a useful check, not a security audit, and it does not replace a proper secrets-management practice.

Common questions

Works well with