Code Security Scanner
45 deterministic security checks across C++, Python, Java, TypeScript, JavaScript, and C# — hardcoded secrets, injection risk, weak crypto, and more.
What the security checks look for
Pattern-based, high-confidence checks — not a full penetration test.
Hardcoded secrets
Checked in all six languages — credentials or keys committed directly into source.
Command & SQL injection
Shell/command execution (system(), os.system, Runtime.exec, child_process.exec, Process.Start) and SQL built by string concatenation.
Unsafe deserialization & eval
Python's pickle.load and unsafe yaml.load, plus eval()/exec() in Python, TypeScript, and JavaScript.
Weak cryptography
Weak hashes (all six languages), weak ciphers (Java, C#), and weak random-number generation (C++) where a cryptographically secure source matters.
XSS & disabled TLS
Unsafe innerHTML use (TypeScript, JavaScript) and disabled TLS certificate validation (TypeScript, JavaScript, C#, plus permissive TrustManagers in Java).
Rolled into one report
Every hit is tagged by language and severity in the same report as your complexity and duplication metrics — no separate security-only scan to run.
Frequently asked questions
Is this a replacement for a real security audit?
No. These are deterministic, pattern-based checks for well-known anti-patterns — useful for catching common mistakes early, not a substitute for a professional security review or a full SAST/DAST pipeline.
Does it find zero-day vulnerabilities?
No — it flags known risky patterns (hardcoded secrets, injection-prone code, weak crypto), not novel vulnerability classes.
Which languages get security checks?
All six supported languages have their own security rule set: 7–8 checks each, 45 in total.
Does REPO-SIGHT exploit anything it finds?
No. It's read-only static analysis — nothing is executed, and no proof-of-concept exploitation happens against your repository.
By language
Related
Scan a repository in seconds.
No tiers and no paywalled metrics; a small amount of advertising pays for hosting. Sign-in is optional for public repositories and required for private ones.