Pricing

$1 an audit. No subscription, and nothing per developer.

You pay for what runs. An audit is one run over one commit; if the commit has not changed, there is nothing to pay for.

Before you pay

This is a pre-order.

Paid scanning is not live yet, and there is no way to add balance — so when the free balance is spent, publishing stops until it is. Nothing can be charged to anybody today. Your balance becomes usable when paid scanning goes live. Until then this is a pre-order: you are buying audits at the early-access rate, not audits you can run today.

Early access

$10 buys 15 audits. At $1 each that money is 10, so 5 of them are the early-access extra. The balance does not expire.

You can ask for a full refund of anything unused within 7 days of paying — counted from the day you pay, not from the day scanning goes live.

The payment link is not open yet. Leave an address below and we will write when it is.

What an audit is

One run over one commit of one repository, and what it reports is: how your project is actually connected — screens, routes, modules, files and data stores; which of those connections resolve to nothing; what a change on this branch would touch, as a floor and never as a guess; where the database is asked for something once per item instead of once; and what is exposed, including credentials written into source.

The scan runs on your own machine and prints what it found for nothing, every time. Publishing the audit to your dashboard — where it is kept, and can be read and shared — is what costs $1.

$1 per repository per day your default branch is pushed. Checks on pull requests are included.

Every audit the CLI publishes is $1, one by one.

Verify your email and you get $3 of balance — 3 published audits, with nothing to enter.

Set a monthly limit in billing and nothing is charged past it — unless you pass --over-limit yourself, which the ledger records as exactly that.

What is never charged

Unchanged code
An audit of a commit we have already audited returns the one we have and costs nothing. The check is the commit and a hash of every file in it, so it is the same code rather than the same name.
The local scan
Running the scan and reading its terminal summary is free, every time, on every repository.
An audit we could not do
Below 70% of a repository resolved we draw no architecture at all, say which languages had no reader, and charge nothing for it.
A repository already audited today
A repository is $1 for the UTC day its default branch is pushed, however many times you push it. Push forty times and it is still $1 — the day's charge decides what is charged, not what is checked. Checks on pull requests are charged nothing, and run while there is at least $1 in the account.
An audit that found nothing
If the audit comes back with no actionable finding at all, the charge is returned automatically in the same request — and you can see both entries in the ledger.
Anything that failed on our side
If it broke because of us, the charge is refunded automatically and the reason is on the page.

What this does not include yet

Paid scanning is not live, which is what the note at the top of this page means. Beyond that, two things people ask for are not built and are not being sold here: there is no dependency vulnerability scanning, and there is no per-developer reporting of any kind — no scores, no leaderboards, and no view of who wrote what. The second is a decision rather than a gap, and it is not going to change.

Not ready yet?

Leave an address and we will write once, when paid scanning goes live.