Stop shipping
hackable code

The CLI scans on your machine; XploitScan's servers never receive your source files. Its network calls are a dependency lookup (package names and versions only) and, if you're logged in, a plan check plus an upload of the findings report, including a few lines of code around each finding, which we strip before storing. If ANTHROPIC_API_KEY is set, it also sends code to Anthropic under your own key for AI analysis; unset it to keep your code off Anthropic. The web scanner processes files in memory and never writes them to disk or a database. To filter false positives, short excerpts around each finding are sent to our AI provider, Anthropic, which may keep them for up to 30 days. Signed-in users can turn this off in Settings for scans started from the Scan page. We store scan results (grade, score, and each finding's rule, file, line and fix, plus a masked preview of detected secrets), not your files.

Vulnerability rules focus on JavaScript and TypeScript (including React, Next.js, Vue and Svelte) and Python, with some rules for Ruby, Go, Java and PHP. Hardcoded-secret detection also runs on the other source files the scanner reads, such as Rust, Swift, Kotlin, C#, Dart and C/C++. We also scan config files: Dockerfile, docker-compose, Terraform, Kubernetes manifests, CI/CD workflows, .env files, and package manifests. On top of languages, the auth checks recognise the shapes AI builders actually emit: Next.js App Router routes and server actions, Express and Hono routes, Supabase Edge Functions, Vercel serverless functions, and Netlify functions.

Traditional SAST tools are built for hand-written enterprise code, and their findings often take security expertise to interpret. XploitScan is purpose-built for AI-generated code — our 223 rules target the specific patterns that AI tools produce, and every finding is explained in plain English with guidance on how to fix it.

Detection quality is public. Checked daily and rerun when rules or fixtures change (at least weekly); updates go live with the next deploy. It is scored against a labeled corpus of 615 fixtures, and the numbers are live at xploitscan.com/benchmark. Current: 97.0% recall. We also run Semgrep and Bearer against the same corpus for side-by-side comparison. The corpus, runners, and methodology are open-source at github.com/bgage72590/xploitscan-benchmark — anyone can reproduce the free-plan (30-rule) scores locally, and the full 223-rule scores with a paid plan's API key. Tracked-but-not-yet-detected cases are shown openly on the page rather than hidden.

CLI scans run on your machine. Without an ANTHROPIC_API_KEY, the only network calls are a dependency-vulnerability lookup (package names and versions, never code) and, if you're logged in, a plan check and an upload of the findings report (rule IDs, file paths, line numbers, and a few lines of code around each finding) to power your dashboard; we strip those code lines before storing. If ANTHROPIC_API_KEY is set, the CLI also sends code to Anthropic under your key for AI analysis; unset it to keep your code off Anthropic. Web scans are analyzed in memory and never written to disk, but short excerpts around findings are sent to Anthropic for false-positive filtering (signed-in users can turn this off in Settings for scans started from the Scan page). We keep scan results for your dashboard, never your source files.

Free plan: 5 scans per day and 5 AI reviews/day (AI reviews reset with scans at 00:00 UTC: 8 PM ET in summer, 7 PM in winter) with 30 core security rules. Indie plan ($9/mo): 500 scans per month with all 223 rules. Pro plan ($19/mo): unlimited scans with all 223 rules, plus PDF reports from your scan history, SBOM generation, Slack/Discord webhooks, and a Trust Page with live scan results. The same split applies in the CLI, GitHub Action, VS Code extension and MCP server: each runs the 30 free rules on its own, and all 223 once you give it an API key from a paid plan. Annual plans save over 40%.

Yes! Use our official GitHub Action to scan on every PR. It outputs SARIF for the GitHub Security tab and can block merges when critical vulnerabilities are found. Run 'npx xploitscan@latest scan . --format sarif' in any CI pipeline.

Scan time depends on the tree. Small projects usually finish in a few seconds; larger ones take longer. The CLI often feels faster because it runs on your machine.

Yes — paste a public repo URL in the web scanner, or use the CLI locally for private repos: 'npx xploitscan@latest scan /path/to/repo'. The CLI never uploads your files; if you're logged in it sends the findings report (which includes short code snippets, stripped before storage).

Yes — save over 40% with annual billing. Indie is $4.92/mo ($59/year), Pro is $9.92/mo ($119/year), and Team is $58.25/mo billed annually ($699/year). You can switch between monthly and annual at any time from Settings → Billing. If you already pay, the change is prorated and takes effect immediately. If you're on a trial, the trial end date stays the same and you are not charged until it ends.

Yes — Team $99/mo self-serve, or $699/year. Subscribe from the pricing page. New subscribers get a 7-day free trial (one trial per customer; not available if you have had an XploitScan trial or paid subscription before).

Yes — the referral program is available to Pro subscribers (owners and admins only). Go to Settings → Referral to get your unique referral link. When someone signs up using your link and subscribes to a paid plan, you receive a credit equal to 1 free month of your current plan applied to your next invoice.

No. New subscribers get a 7-day free trial (one trial per customer; not available if you have had an XploitScan trial or paid subscription before). Indie has no free trial.

Go to Settings → Billing → Manage Subscription. You can cancel, upgrade, or downgrade anytime. Cancellations keep your access until the end of your billing period. If you already pay, the change is prorated and takes effect immediately. If you're on a trial, the trial end date stays the same and you are not charged until it ends. No cancellation fees.

Yes — findings are tagged with OWASP Top 10 categories and CWE IDs, with informational SOC2 Trust Service Criteria and ISO 27001 Annex A cross-references on the Compliance page. Note: compliance mappings are informational — they help you understand your security posture but are not a substitute for a formal compliance audit.