Quickstart
SecureOS is an AI-native security platform: connect a repository, and it scans, triages, and opens fixes as pull requests. Here's your first scan in under two minutes.
1. Sign in
Google and email/password sign-in only ask for your identity — nothing about your code. GitHub is requested separately, at the exact moment you connect a repository, so you can look around before granting access to anything.
2. Connect a repository
From Repositories, connect the repo you want scanned. SecureOS reads it in the background — architecture, entry points, trust boundaries — so the first scan already knows your code instead of guessing at it.
3. Run a scan
From Scans, click New scan. You'll see it progress live, then land on its findings — each with severity, location, why it was flagged, and a suggested fix you can apply directly from the page.
About Levin
Levin is the assistant docked in the corner of every page. It answers questions about what SecureOS has found — it doesn't start scans, open pull requests, or change anything on its own.
Click a finding to attach it to the conversation, then ask about it directly: "does this concern my auth?" or "how would someone actually exploit this?" are fair questions. Levin answers from the specific finding and its scan, not a guess.
If the scan behind what you're asking about is more than a few days old, Levin will say so and suggest running a fresh one before you rely on the answer — code moves faster than a stale scan can account for.
The workspace
Everything lives in one dashboard. A few sections are still being built — marked soon below rather than shown as if they already worked.
Your security score, open issues, and a setup checklist that tracks what's actually connected.
Every scan you've run, with live progress while one is in flight and a full findings breakdown once it completes.
Every finding across every scan, in one filterable list — the cross-scan record Scans doesn't try to be.
Every pull request SecureOS has reviewed, bucketed by whether it's awaiting merge, needs attention, or already shipped with open findings.
Dependency and extension risk across your lockfiles.
Every connected repo, whether its automatic PR review webhook is actually healthy, and a one-click fix when it isn't.
External attack surface for domains you own — DNS hygiene, exposed subdomains, and commonly-leaked paths. Gated on proving ownership before anything is probed.
The 754-skill security library SecureOS draws on when it plans a scan, searchable by technique or technology.
Send findings to Slack, Jira, or Linear.
Personal access keys for the Vigil editor extension exist today; a general REST API for triggering scans is not built yet.
PR Review
SecureOS reviews every pull request on a connected repository automatically — opened, reopened, or pushed to again — and comments the findings inline on the diff, not the whole codebase, so reviews stay fast.
How it works
A pull request event reaches SecureOS through a webhook registered when you connect the repo, scans only the changed files, and posts back to GitHub. Settings on the PR Reviews page control the details: which severities block a merge, whether clean PRs get an automatic approval, branches to exclude, and bot accounts to skip.
## 🛡️ SecureOS Security Review — PR #247
🔴 Critical — SQL Injection [CWE-89]
const q = `SELECT * FROM users WHERE id = ${id}`
Attacker-controlled input reaches the query unparameterised.
Use a parameterised query instead.Setup
PR review turns on automatically when you connect a repository — no separate configuration required. If a repo shows Not connected next to its auto-review status on the Repositories page, its webhook needs repairing; click Fix to re-register it.
Security Checks
The static analysis engine runs 39+ checks across 8 categories on every scan. Every check carries a CWE reference and a severity rating.
Playground
The Playground scans any public GitHub repository without creating an account — the fastest way to see what SecureOS finds before connecting anything of your own.
Usage
Go to secureos.dev/playground and enter a public repository URL. The scan runs server-side and returns results in seconds.
https://secureos.dev/playground?repo=owner/repositoryAPI
Personal access keys already exist for the Vigil editor extension, generated from your account settings. A general-purpose REST API — trigger a scan, list findings, integrate with CI/CD — is not built yet.
To get early access or request a feature, contact us.