Stop shipping
hackable code

The CLI scans on your machine; XploitScan's servers never receive your source files. Its network calls are a dependency lookup (package names and versions only) and, if you're logged in, a plan check plus an upload of the findings report, including a few lines of code around each finding, which we strip before storing. If ANTHROPIC_API_KEY is set, it also sends code to Anthropic under your own key for AI analysis; unset it to keep your code off Anthropic. The web scanner processes files in memory and never writes them to disk or a database. To filter false positives, short excerpts around each finding are sent to our AI provider, Anthropic, which may keep them for up to 30 days. Signed-in users can turn this off in Settings for scans started from the Scan page. We store scan results (grade, score, and each finding's rule, file, line and fix, plus a masked preview of detected secrets), not your files.

Vulnerability rules focus on JavaScript and TypeScript (including React, Next.js, Vue and Svelte) and Python, with some rules for Ruby, Go, Java and PHP. Hardcoded-secret detection also runs on the other source files the scanner reads, such as Rust, Swift, Kotlin, C#, Dart and C/C++. We also scan config files: Dockerfile, docker-compose, Terraform, Kubernetes manifests, CI/CD workflows, .env files, and package manifests. On top of languages, the auth checks recognise the shapes AI builders actually emit: Next.js App Router routes and server actions, Express and Hono routes, Supabase Edge Functions, Vercel serverless functions, and Netlify functions.

Traditional SAST tools are built for hand-written enterprise code, and their findings often take security expertise to interpret. XploitScan is purpose-built for AI-generated code — our 223 rules target the specific patterns that AI tools produce, and every finding is explained in plain English with guidance on how to fix it.

Detection quality is public. Checked daily and rerun when rules or fixtures change (at least weekly); updates go live with the next deploy. It is scored against a labeled corpus of 649 fixtures, and the numbers are live at xploitscan.com/benchmark. Current: On our own 649-fixture labeled benchmark: 97.2% recall. Of 292 clean fixtures, 82% produce no false-positive findings. Counting the 99 findings on clean fixtures that the Nov 3, 2026 hand review judged to be false positives, after the Nov 4 rule fixes, precision is 86.3%. We built and labeled this benchmark ourselves; results on your code will differ. We also run Semgrep and Bearer against the same corpus for side-by-side comparison. The corpus, runners, and methodology are open-source at github.com/bgage72590/xploitscan-benchmark — anyone can reproduce the free-plan (30-rule) scores locally, and the full 223-rule scores with a paid plan's API key. Tracked-but-not-yet-detected cases are shown openly on the page rather than hidden.

CLI scans run on your machine. Without an ANTHROPIC_API_KEY, the only network calls are a dependency-vulnerability lookup (package names and versions, never code) and, if you're logged in, a plan check and an upload of the findings report (rule IDs, file paths, line numbers, and a few lines of code around each finding) to power your dashboard; we strip those code lines before storing. If ANTHROPIC_API_KEY is set, the CLI also sends code to Anthropic under your key for AI analysis; unset it to keep your code off Anthropic. Web scans are analyzed in memory and never written to disk, but short excerpts around findings are sent to Anthropic for false-positive filtering (signed-in users can turn this off in Settings for scans started from the Scan page). We keep scan results for your dashboard, never your source files.

Free plan: 5 scans per day and 5 AI reviews/day (AI reviews reset with scans at 00:00 UTC: 8 PM ET in summer, 7 PM in winter) with 30 core security rules. Pro plan ($19/mo): unlimited scans with all 223 rules, plus PDF reports from your scan history, SBOM generation, Slack/Discord webhooks, and a public Trust Page that can show the grade and date of your most recent scan (not an audit or certification). The same split applies in the CLI, GitHub Action, VS Code extension and MCP server: each runs the 30 free rules on its own, and all 223 once you give it an API key from a paid plan. 2 months free with annual billing.

Yes! Use our official GitHub Action to scan on every PR. It outputs SARIF for the GitHub Security tab and can block merges when critical vulnerabilities are found. Run 'npx xploitscan@latest scan . --format sarif' in any CI pipeline.

Scan time depends on the tree. Small projects usually finish in a few seconds; larger ones take longer. The CLI often feels faster because it runs on your machine.

Yes — paste a public repo URL in the web scanner, or use the CLI locally for private repos: 'npx xploitscan@latest scan /path/to/repo'. The CLI never uploads your files; if you're logged in it sends the findings report (which includes short code snippets, stripped before storage).

Yes — get 2 months free with annual billing. Pro is $15.83/mo ($190/year), and Team is $82.50/mo billed annually ($990/year). You can switch between monthly and annual at any time from Settings → Billing. Switching plan or billing interval ends a founding rate. If you already pay, the change is prorated and takes effect immediately. If you're on a trial, the trial end date stays the same and you are not charged until it ends. The founding rate is $119/yr for annual Pro or $699/yr for annual Team, for new annual subscriptions started Nov 2–30, kept as long as you keep renewing the same plan and billing interval. It ends if you cancel, let the subscription lapse, or switch plan or billing interval. Limited to 20 Pro and 5 Team subscriptions. Switching an existing monthly Pro or Team subscription to annual billing doesn't qualify. Terms apply → Switching an existing monthly Pro or Team subscription to annual billing doesn't qualify for the founding rate.

Yes — Team $99/mo self-serve, or $990/year. Subscribe from the pricing page. New subscribers get a 7-day free trial (one trial per customer; not available if you have had an XploitScan trial or paid subscription before).

Yes — the referral program is available to Pro subscribers (owners and admins only). Go to Settings → Referral to get your unique referral link. When someone signs up using your link and subscribes to a paid plan, you receive a credit equal to 1 free month of your current plan applied to your next invoice.

No. New subscribers get a 7-day free trial (one trial per customer; not available if you have had an XploitScan trial or paid subscription before).

Go to Settings → Billing → Manage Subscription. You can cancel, upgrade, or downgrade anytime. Cancellations keep your access until the end of your billing period. If you already pay, the change is prorated and takes effect immediately. If you're on a trial, the trial end date stays the same and you are not charged until it ends. No cancellation fees.

Yes — findings are tagged with OWASP Top 10 categories and CWE IDs, with informational SOC2 Trust Service Criteria and ISO 27001 Annex A cross-references on the Compliance page. Note: compliance mappings are informational — they help you understand your security posture but are not a substitute for a formal compliance audit.