Plans and pricing

The scanner is free. Teams pay for the tools around it.

Community is the whole scanner, open source, with nothing held back. The paid plans add tools for working through findings over time and across a team. They read what the scanner found; they never change what it found or how it is labelled.

Community
Free
for everyone, for good
Open source, AGPL-3.0

Anyone scanning their own code, on their own machine or in their own CI.

Included:
  • The scanner8 languages and 10 rules. Data flow is traced in every language, into other functions, and into other files in every language but PHP.
  • Two labels on every findingProven, with the path from source to sink printed; or to review, a matched pattern that was not traced. Never blended into one score.
  • What it did not checkEvery run lists the rule and language pairs it does not cover - 22 today - each with its reason.
  • Terminal, browser and CIA terminal command, a browser page that scans on your own machine and uploads nothing, JSON output, and SARIF for GitHub code scanning.
  • Client reportOne HTML file for a client or a manager, with the proven problems, what to review and what was not checked. Prints to PDF.
Run it now
Pro
$19
per developer / month

One developer working through findings over time, on their own machine.

Everything in Community, and:
  • New problems onlyCompare two scans and see only what a change added. A line that moved is matched, not called new; what disappeared is "no longer reported", never "fixed".
  • Trend dashboardProven and to-review counts across your scans, in one file that opens offline. Where the scanner itself changed, the point is marked with the reason.
Ask for Pro
Team
$49
per developer / month
From 5 developers ($245 a month). 14-day trial on request.

A team that wants every pull request checked, and one shared record of what was decided.

Everything in Pro, and:
  • Pull-request checkEach pull request is scanned against its base. One comment, updated on every push, lists only what it adds, and the check fails only on new problems at the level you set.
  • Shared triageFalse alarms and accepted risks are marked in the repository with a reason and a name. A mark never hides a finding, ends when the code changes, and a pull request cannot approve its own.
  • Automatic historyOne scan a day kept on its own branch, and the trend dashboard rebuilt on every push to main. On private repositories, unless you choose otherwise.
Ask for Team
Business
Coming soon

Organisations that want one yearly price.

Not available yet. If you need it, say so - it will be shaped around real requests rather than guessed at.

Tell us you need it
Enterprise
Coming soon

Large organisations with their own terms and reviews.

Not available yet. If you need it, say so - it will be shaped around real requests rather than guessed at.

Tell us you need it

Prices in US dollars. There is no checkout yet - see how buying works below.

The same in every plan

Paying never makes
a guess look like a proof.

The scanner decides

The paid tools read the scanner's own output. They organise findings - compare them, mark them, chart them - and never re-decide or relabel one.

Nothing is hidden

A finding your team marks is still listed, with the reason beside it. A comparison never calls a finding fixed; it says "no longer reported", because that is all it can know.

Your code stays with you

Everything runs on your machine or in your own CI. There is no account to make and nothing is uploaded anywhere.

The work behind it

Measured, and
published whole.

The engine is scored against OWASP BenchmarkJava, with the two labels scored separately. Safety rules are switched off one at a time to prove a test notices. And the scanner is run on large real projects - Django, WordPress and VS Code among them - to find what synthetic tests miss. The measurements, and what they do not promise, are on the main page.

1,210benchmark cases scored
10rules
8languages traced
22gaps listed by name
How buying works, today

Set up by hand,
for now.

  1. Ask using the button on the plan you want. It opens a short request form on GitHub.
  2. Hear back privately, with the licence terms and an invoice.
  3. Get the package - a file your machine or your CI installs next to the scanner.

The request form is public. Write only the plan, the number of developers and how to reach you privately - never code, keys or company details.

Would rather have a person run it for you? The security check is from ₹9,999 per project - see what it includes.