New · GitHub App

Security checks on every pull request.

Install once. Every PR gets scanned for hardcoded secrets, SQL injection, missing auth, XSS, and the rest of the 223-rule set. Findings show up in a check on the PR, where you review.

Install on GitHub →See pricing

Free for public repos and small projects. No credit card required.

What you get on every PR

A pass/fail Check Run

Every PR shows an XploitScan check. Critical or high findings fail the check; medium and low are advisory. Wire it as a required check to block merges.

Findings on the PR

The check's summary lists each finding with its severity, rule ID, file and line — right on the pull request you're reviewing.

Tier-aware detection

Free covers 30 core rules. Paid plans unlock the full 223-rule set; Pro and Team add an AI false-positive filter that drops noisy matches before they reach you.

What it catches

✓Hardcoded API keys, AWS credentials, Stripe secrets
✓SQL injection via template literals
✓XSS through dangerouslySetInnerHTML / innerHTML
✓Missing webhook signature verification (Stripe, Clerk, GitHub)
✓Reflected CORS allowing arbitrary origins
✓API routes missing authentication
✓Command injection via child_process.exec
✓IDOR — missing ownership checks on user-scoped data
✓Server-side request forgery (SSRF) patterns
✓Insecure deserialization (Python pickle, Java)

Plus the rest of the 223-rule set, curated specifically for AI-generated code.

How it works

  1. 1

    Install on your account or org

    Pick which repositories XploitScan can see. Public, private, or both — your call.

  2. 2

    Open a pull request

    The App scans the changed files at the PR's HEAD commit.

  3. 3

    See findings on the PR

    A Check Run lands on the PR with a severity breakdown and a list of findings.

  4. 4

    Fix and push

    Each push re-scans automatically. Resolved findings drop off; new findings appear.

Install the GitHub App →