Free Source Code Security Scan: Find Vulnerable Code, Dependencies and Leaked Secrets
Scan a .zip or a GitHub, GitLab, Bitbucket or Azure DevOps repository for free with Ostorlab: static analysis of your code, vulnerable dependencies and hardcoded secrets, with the report emailed to you.
Free Source Code Security Scan: Find Vulnerable Code, Dependencies and Leaked Secrets
Quick answer: You can scan your source code for vulnerabilities for free with Ostorlab. Upload a .zip or connect a repository. The free scan checks three things: your code, your dependencies and any hardcoded secrets. The report is emailed to you.
What the free scan checks
| Check | What it finds | Example |
|---|---|---|
| Code (SAST) | Insecure patterns in your own code | SQL built from user input, weak cryptography, unsafe deserialization |
| Dependencies (SCA) | Libraries with known CVEs | An outdated logging or XML library with a public exploit |
| Secrets | Credentials committed to the code | AWS keys, API tokens, private keys, database passwords |
The scan is static. Nothing is built or executed, so it's safe to run on any branch.
Two ways to start
- Upload a .zip. This is the fastest way. Archive the project, drop it in the form at ostorlab.co, and enter your email.
- Connect a repository. Link GitHub, GitLab, Bitbucket, Azure DevOps or self-hosted Git on the Ostorlab platform, then pick the repository.
Why leaked secrets matter most
A leaked key is often the first step of an attack chain. A token left in a repository can still be accepted by your API and used from your mobile app. Each scan on its own may look clean, but together they form an attack path. Ostorlab's paid multi-asset scan tests the code, APIs and apps together to find those paths. For more on how keys leak and how to check them, see Finding and Validating Hardcoded Keys and Secrets.
What the free scan doesn't cover
The free scan doesn't build the code, run it or try to exploit what it finds. To confirm which findings are actually exploitable in your running app, use Agentic Deep Scan. For how the two fit together, read Can an AI Agent Prove SAST Findings at Runtime?.
Comparing tools first? See Best SAST Tools in 2026.
Try it on your own code: scan your source code for free.
FAQ
Is there a free SAST tool for GitHub repositories? Yes. Ostorlab scans GitHub, GitLab, Bitbucket, Azure DevOps and self-hosted Git repositories for free, as well as .zip archives.
Does the free source code scan find hardcoded secrets? Yes. It looks for credentials committed to the code, such as AWS keys, API tokens, private keys and database passwords.
Does the free source code scan run my code? No. It's static analysis of the code, dependencies and secrets. Nothing is built or executed.
Which languages are supported? The scan covers polyglot and mixed-language repositories. See the full list of supported languages.