For business · Code Scanner

A security review of your code, with the proof attached.

Code Scanner’s AI agents read your GitHub repositories as a security engineer would, look for weaknesses an attacker could use, and try each one in a sealed sandbox before they report it.

How a scan works

From a repository to a short list of real problems

  1. Connect GitHub
    Install the heySec Code Scanner app on your GitHub account or organisation and pick the repositories. It can read code, and nothing else.
  2. It maps the system
    The agents first learn what the code does: where outside input comes in, what it reaches and who could reach it.
  3. It hunts, then doubts
    Some agents look for weaknesses an attacker could use. Others challenge every lead and merge the ones that are the same problem.
  4. It tries what it found
    A lead that holds up gets a proof of concept, run in a sandbox with no way out to the network. One it cannot confirm is marked “Needs validation”.
  5. It proposes the fix
    A change to your code, and a test that fails before the change and passes after it.

What a finding holds

Enough to act on, without a second investigation

Where it is
The files and lines involved, each linked to GitHub at the commit that was scanned.
Who could use it
The attacker, what they start with, and how exposed it is: from anyone on the internet to someone already on the machine.
The proof
The steps, the proof of concept and its command, and whether it ran in the sandbox.
The fix
A proposed change and a regression test. You review it and apply it yourself.
How urgent it is
A priority from P1 to P4, so the overview can put what to fix first at the top.

P1 · SQL injection in the notes search

api/notes.py, line 42
Anyone signed in can read every user's notes.

Proposed change

- q = ("SELECT * FROM notes"
-      f" WHERE title LIKE '%{s}%'")
- rows = db.execute(q)
+ q = ("SELECT * FROM notes WHERE owner=?"
+      " AND title LIKE ?")
+ rows = db.execute(q, (user.id, f"%{s}%"))

Regression test

Fails before the change, passes after it

Scans and schedules

A second pair of eyes on every release

Run a scan when you need one, or put it on a schedule in your own time zone.

  • As wide as you need. The whole repository, chosen paths, or only what changed since the last scan.
  • Only when something changed. A scheduled scan can skip itself when there is no new commit.
  • Told when it matters. An email when a scan finishes, with any new P1 and P2 findings, and when one fails.
  • Your call on every finding. Mark it fixed, a false positive or an accepted risk. A later scan reopens a fixed finding that comes back.

Private first

Your code is read, never kept around

Every scan gets its own machines, and they are deleted when it ends.

  • Your code runs sealed off. Only inside a sandbox, on a machine of its own that holds no keys and reaches nothing but the scan that sent it.
  • Never in a log. A finding keeps the lines it is about, with any secret in them masked. The agents’ working notes are deleted after 14 days.
  • Read by AI models. To understand your code, the agents send parts of it to AI models from the providers we work with, under business terms that rule out training on it.
  • Scanned in the EU. The machines that fetch and run your code are on EU servers.

Questions, answered

Does it find everything?

No review does, by a person or a machine. A scan also has a time and size budget; when it runs out, the scan says which parts of the code it covered. Use it beside your own reviews and tests, not instead of them.

Which languages does it read?

Any language the code is written in. To try what it finds, the sandbox can build and run PHP, Python, JavaScript, Go, Rust, Java, C and C++.

Does it change my code?

No. Its access to GitHub is read-only, so it never pushes, merges or opens pull requests. Fixes come as a proposed change for you to apply.

Can it scan a system that lives in several repositories?

Yes. Group the repositories of one system into a codebase and they are scanned together, as one tree, so a weakness that crosses from one to another is followed all the way.

Can I use the findings in my own tools?

Export them as SARIF, JSON, CSV, Markdown or HTML, most urgent first.

Find the weak spots before you ship

Code Scanner is in private testing. Join the waitlist and we will invite you as places open.

Join the waitlist