Beyond pull requests
Repository scans
Scan a whole branch for secrets, vulnerable dependencies, licenses, dead code and risky functions.
A repository scan reviews a whole branch rather than one change: useful when you adopt a codebase, before a release, or to see where the risk is in a project you already own.
Start a scan#
In Repository scan, pick a repository from GitHub, GitLab or Bitbucket and a branch, or upload a .zip. The report opens when the scan finishes, and stays in your account until you delete it.
What a scan checks#
| Check | Finds |
|---|---|
| Secrets | API keys, tokens, passwords and private keys committed to the code, including in generated files |
| Dependencies | Packages with known vulnerabilities |
| Licenses | Dependency licenses that may conflict with how you ship |
| Dead and duplicate code | Unused exports and files, copy-pasted blocks |
| Structure | The frameworks in use, the import graph and circular imports |
| Test coverage | An estimate of how much of the code has tests |
| Architecture | How consistent the layering is across core files |
| AI review | The riskiest files, reviewed in depth like a pull request |
Limits#
- The AI reviews up to 40 of the riskiest files per scan; the local checks cover everything.
- Files over 200 KB are skipped.
- Uploaded archives can hold up to 3,000 files and 500 MB uncompressed.
- Generated and vendored code is excluded, and your ignore rules apply.
Scans that use the AI count toward your plan’s monthly repository scans. See Plans and limits.
The free public scan#
auditbenchai.com/scan checks any public GitHub repository or pull request without an account.
- It runs the local checks only. No code is sent to an AI provider.
- Repositories up to 250 MB. Pull requests up to 40 changed files of 200 KB each; a pull request scan also reports merge readiness (conflicts, draft state, CI).
- Each visitor can run three scans an hour. Results for the same repository and branch are reused for 24 hours.
- Every scan gets a shareable link.
Sharing reports#
Any report you own can be shared with a link, and unshared again, from the report page. Shared reports show findings, file paths and line numbers.