Pricing
Pay as you go. Cancel any time.
Rule-based and scheduled scans are always free. Each plan includes AI deep scans and fix PRs every month; beyond that you pay per scan and per PR.
Dev
For individual developers: pay only for what you use
$0/ month
No card needed to start
- Repositories
- 1 includedthen $10 / mo each
- AI deep scans
- 2 / monththen $2.50 / $2.75 / $3 each
- Fix PRs
- 2 / monththen $5 each
- Unlimited rule-based scans and scheduled rescans
- Up to 3 members
- 1 GitHub account or organization, with only the repositories you choose
- GitHub, GitLab and Bitbucket
- Jira, ServiceNow and Slack
Startup
For teams shipping fixes every week
$25/ seat / month
Cancel any time
- Repositories
- 3 includedthen $7 / mo each
- AI deep scans
- 15 / monththen $3 each
- Fix PRs
- 5 / monththen $5 each
- Everything in Free
- Add seats any time (prorated)
- Audit logs: 90 days, CSV / JSON export
- Up to 2 GitHub accounts or organizations, with only the repositories you choose
- Up to 2 private package registries (one type)
- Standard support (8-hour P1 response)
- Per-team usage reports
- Invoices and receipts
Enterprise
For organizations that need guarantees
$45/ seat / month
Minimum 3 seats · annual term, billed monthly
- Repositories
- Unlimited
- AI deep scans
- 30 / monththen $2.50 / $2.75 / $3 each
- Fix PRs
- 10 / monththen $4 each
- Custom token volume
- Audit logs: 365 days, CSV / JSON export + SIEM streaming
- Unlimited GitHub accounts and organizations, with only the repositories you choose, scanned on every push
- Unlimited private package registries
- Single sign-on: Microsoft Entra ID, Okta, Google Workspace and other OpenID Connect providers
- API keys and signed webhooks (1,200 requests/min)
- Priority engineering support, 24/7 (1-hour P1 response)
- Dedicated success manager
- Custom SLAs and uptime guarantees
- Custom onboarding and security reviews
- Priority custom integration requests
- Multi-entity support
- SAML single sign-on (coming soon)
What's included, and what beyond it costs
Allowances are shared by the whole organization and reset on the 1st of every month (unused ones don't carry over). Anything beyond them goes on the same monthly invoice. No top-ups, no separate payments.
| Dev | Startup | Enterprise | |
|---|---|---|---|
| Per seat / month | $0 | $25 | $45 |
| Minimum seats | 1 | 1 | 3 |
| Term | Monthly | Monthly | Annual, billed monthly |
| Repositories included | 1 | 3 | Unlimited |
| Each additional repository / month | $10 | $7 | — |
| AI deep scans included / month | 2 | 15 | 30 |
| Each scan beyond: small (up to 20k lines) | $2.50 | $3 | $2.50 |
| Each scan beyond: medium (20k–200k lines) | $2.75 | $3 | $2.75 |
| Each scan beyond: large (over 200k lines) | $3 | $3 | $3 |
| Fix PRs included / month | 2 | 5 | 10 |
| Each fix PR beyond | $5 | $5 | $4 |
| Rule-based and scheduled scans | Free, unlimited | Free, unlimited | Free, unlimited |
| Cancel | Any time | Any time | At renewal |
Enterprise requires at least 3 seats. Prices in US dollars, excluding tax.
Audit logs: security and compliance
Every plan records a tamper-evident log of every action. Paid plans let you search, export and stream it.
| Feature | Dev | Startup | Enterprise |
|---|---|---|---|
| Every action recorded (hash-chained) | |||
| View and search the audit log | — | 90 days | 365 days |
| Filter by action, person, status and date | — | ||
| Export to CSV / JSON | — | ||
| One-click integrity verification | — | ||
| SIEM streaming (Splunk, Datadog) | — | — | |
| Real-time signed webhooks | — | — |
Built for security reviews
Encrypted credentials
Tokens, passwords and personal data are encrypted with AES-256-GCM, with key rotation.
Tamper-evident audit log
Every action is hash-chained, so editing or deleting history is detectable.
Two-factor sign-in
Authenticator apps plus single-use recovery codes. Accounts lock after repeated failed attempts.
Least-privilege access
Owner, admin, developer and viewer roles, custom roles, and team-scoped repository access.
You approve every change
Fixes arrive as pull requests for your team to review. Nothing is pushed to your branches.
Support only with your PIN
Our staff can't see your organization unless you give them a one-time PIN, and it's logged.
Works with your tools
GitHub Git host
Repositories, fix pull requests
GitLab Git host
gitlab.com and self-managed, merge requests
Bitbucket Git host
Bitbucket Cloud, pull requests
Jira Tickets
Issues per finding, closed on merge
ServiceNow Change management
Change requests for every fix
Slack Alerts
High-severity findings and PR updates
Splunk SIEM
Audit log streaming (Enterprise)
Datadog SIEM
Audit log streaming (Enterprise)
Any HTTPS endpoint Webhooks
Signed real-time audit events (Enterprise)
Questions
- What counts as a scan?
- Only AI deep scans that someone starts. Rule-based scans and every scheduled scan are free and unlimited on every plan. A scan that fails isn't billed, and rescanning the same commit within 24 hours doesn't count again.
- How is repository size measured?
- By lines of code (dependencies and build output excluded), measured when the scan runs and kept on that scan. Small (up to 20k lines), Medium (20k–200k lines), Large (over 200k lines). The dashboard shows the size and the price next to the scan button.
- When is a fix PR counted?
- When the pull request is opened. Fixes that fail, or that you cancel before a PR opens, don't count.
- Do I need a card for Dev?
- No. Dev is free within its monthly allowance. We ask for a card only before something would cost money: a scan or fix PR beyond the allowance, or a second repository. One free Dev allowance per company domain, with a verified email.
- How is usage billed?
- Seats and extra repositories are billed monthly, in advance, on the 1st. Scans and fix PRs beyond the allowance are billed in arrears on the same invoice. Your Usage page shows the invoice as it builds up, and we email a summary 3 days before it's issued. You can set a monthly limit on usage charges.
- Can I change plans?
- Upgrades take effect immediately, prorated. Downgrades take effect at the start of the next billing period (Enterprise: at the end of its annual term).
- Can I cancel?
- Yes, from the Billing page. Dev and Startup keep access until the end of the billing period you paid for. Enterprise is an annual term billed monthly: cancelling takes effect at the renewal date.
- What if a payment fails?
- We email you and retry. If it's still unpaid after 7 days, the organization becomes read-only (no new scans, fix PRs or repositories; everything stays viewable) until it's paid.