Quickstart

SecureOS is an AI-native security platform: connect a repository, and it scans, triages, and opens fixes as pull requests. Here's your first scan in under two minutes.

1. Sign in

Google and email/password sign-in only ask for your identity — nothing about your code. GitHub is requested separately, at the exact moment you connect a repository, so you can look around before granting access to anything.

2. Connect a repository

From Repositories, connect the repo you want scanned. SecureOS reads it in the background — architecture, entry points, trust boundaries — so the first scan already knows your code instead of guessing at it.

3. Run a scan

From Scans, click New scan. You'll see it progress live, then land on its findings — each with severity, location, why it was flagged, and a suggested fix you can apply directly from the page.

Free plan: up to 4 connected repositories, unlimited scans, automatic PR review on all of them.

About Levin

Levin is the assistant docked in the corner of every page. It answers questions about what SecureOS has found — it doesn't start scans, open pull requests, or change anything on its own.

Click a finding to attach it to the conversation, then ask about it directly: "does this concern my auth?" or "how would someone actually exploit this?" are fair questions. Levin answers from the specific finding and its scan, not a guess.

If the scan behind what you're asking about is more than a few days old, Levin will say so and suggest running a fresh one before you rely on the answer — code moves faster than a stale scan can account for.

The workspace

Everything lives in one dashboard. A few sections are still being built — marked soon below rather than shown as if they already worked.

Dashboard

Your security score, open issues, and a setup checklist that tracks what's actually connected.

Scans

Every scan you've run, with live progress while one is in flight and a full findings breakdown once it completes.

Issues

Every finding across every scan, in one filterable list — the cross-scan record Scans doesn't try to be.

PR Reviews

Every pull request SecureOS has reviewed, bucketed by whether it's awaiting merge, needs attention, or already shipped with open findings.

Supply Chainsoon

Dependency and extension risk across your lockfiles.

Repositories

Every connected repo, whether its automatic PR review webhook is actually healthy, and a one-click fix when it isn't.

Domains

External attack surface for domains you own — DNS hygiene, exposed subdomains, and commonly-leaked paths. Gated on proving ownership before anything is probed.

Knowledge

The 754-skill security library SecureOS draws on when it plans a scan, searchable by technique or technology.

Integrationssoon

Send findings to Slack, Jira, or Linear.

APIsoon

Personal access keys for the Vigil editor extension exist today; a general REST API for triggering scans is not built yet.

PR Review

SecureOS reviews every pull request on a connected repository automatically — opened, reopened, or pushed to again — and comments the findings inline on the diff, not the whole codebase, so reviews stay fast.

How it works

A pull request event reaches SecureOS through a webhook registered when you connect the repo, scans only the changed files, and posts back to GitHub. Settings on the PR Reviews page control the details: which severities block a merge, whether clean PRs get an automatic approval, branches to exclude, and bot accounts to skip.

## 🛡️ SecureOS Security Review — PR #247

🔴 Critical — SQL Injection [CWE-89]

  const q = `SELECT * FROM users WHERE id = ${id}`

Attacker-controlled input reaches the query unparameterised.
Use a parameterised query instead.

Setup

PR review turns on automatically when you connect a repository — no separate configuration required. If a repo shows Not connected next to its auto-review status on the Repositories page, its webhook needs repairing; click Fix to re-register it.

Security Checks

The static analysis engine runs 39+ checks across 8 categories on every scan. Every check carries a CWE reference and a severity rating.

Injection6 checks
Eval Usagecritical
SQL Injection (concat)critical
SQL Injection (f-string)critical
OS Command Injectioncritical
Shell Subprocess Injectionhigh
Server-Side Template Injectionhigh
Secrets7 checks
OpenAI API Key Exposedcritical
AWS Access Key Exposedcritical
Stripe Live Key Exposedcritical
GitHub Token Exposedcritical
Private Key Blockcritical
Database Connection Stringcritical
High-Entropy Secrethigh
Auth6 checks
JWT Verification Disabledcritical
JWT Not Verifiedcritical
Hardcoded Admin Credentialscritical
MD5 Password Hashinghigh
Weak Secret Keyhigh
Auth Token in localStoragehigh
Crypto4 checks
RC4 Cipher Usagehigh
AES-ECB Modehigh
Static IV in Encryptionhigh
Math.random() for Tokensmedium
JWT3 checks
JWT Algorithm: Nonecritical
JWT Expiry Not Checkedhigh
Weak JWT Secrethigh
Config4 checks
CORS Wildcard (*)high
Debug Mode Enabledhigh
Insecure Cookiemedium
Admin Route Without Authhigh
Storage3 checks
S3 Public ACLcritical
Hardcoded Database URLcritical
Firebase Open Read/Writehigh
IaC6 checks
Privileged Containercritical
.env File Committedcritical
Secret in Env Variablecritical
Container Running as Roothigh
Host Network Modehigh
K8s Privileged Containercritical

Playground

The Playground scans any public GitHub repository without creating an account — the fastest way to see what SecureOS finds before connecting anything of your own.

Usage

Go to secureos.dev/playground and enter a public repository URL. The scan runs server-side and returns results in seconds.

https://secureos.dev/playground?repo=owner/repository
The Playground scans the default branch of public repositories only. Private repos need a connected account.

API

Personal access keys already exist for the Vigil editor extension, generated from your account settings. A general-purpose REST API — trigger a scan, list findings, integrate with CI/CD — is not built yet.

Coming soon:scan-triggering and findings endpoints, for CI/CD pipelines that want SecureOS results without opening the dashboard.

To get early access or request a feature, contact us.