Straight answers about GitHub access, repository scans, plans, billing, and the limits of automated security checks.
SecureRepos checks connected GitHub repositories for exposed secrets, broad GitHub Actions permissions, risky Dockerfile and infrastructure patterns, known vulnerable dependency versions across supported package ecosystems, and repository hygiene issues.
SecureRepos is operated by Secure Repos. For account, billing, legal, or support questions, contact [email protected].
No. It is an automated scanning and workflow tool. It helps surface likely issues and keeps ownership visible, but findings still need human review before you treat them as confirmed vulnerabilities.
After email verification and checkout, users install the SecureRepos GitHub App and select repositories they are authorized to monitor. Each SecureRepos account is permanently linked to the first GitHub account it connects.
The service uses GitHub App access to inspect repository content needed for scans. Repository code is processed for scanning and temporary scanner workspaces are removed after parsing. Scan results, finding metadata, selected file paths, and account activity are stored for your account. SecureRepos does not sell repository code.
Dependency alerts are useful, but they focus mainly on vulnerable packages. SecureRepos adds repository-level checks for secrets, CI/CD workflow risk, Docker and infrastructure configuration, repository hygiene, risk summaries, scan history, remediation context, CLI access, MCP access, and critical/high alert channels.
Yes. Findings are generated by automated rules and need human review. A finding can be a real risk, an intentional configuration decision, or a false positive depending on the repository context.
No. SecureRepos plans are designed for one developer account. Login credentials and account access should not be shared with another person.
Checkout is handled by Paddle and requires a payment method to prevent abuse and keep private repository scanning sustainable. The 7-day Security Preview includes one repository and one limited scan. Unless cancelled, Paddle charges the card when the preview ends and the selected paid plan activates automatically.
No. It checks a small default-branch sample and displays up to five sample findings, with useful context on the first high-value items. Full scheduled scanning, complete evidence, and plan-specific automation unlock with the paid subscription.
If your plan renews, you can request cancellation through available account options or by contacting support. Cancellation stops future renewal according to checkout terms, but it does not automatically refund prior charges.
SecureRepos is a digital SaaS product. Once an account is activated and access is delivered, fees are generally non-refundable unless required by law or approved by support. Billing errors and duplicate charges can be reviewed by contacting support.
You can remove or suspend the GitHub App installation from GitHub, but doing so stops repository sync and scans. The original GitHub account remains permanently bound to the SecureRepos account and cannot be replaced through self-service.
Your plan controls how many active repositories can be monitored. If more repositories are available through GitHub, SecureRepos may keep only the allowed number active until your plan changes or more capacity becomes available.
Email [email protected] or use the contact form. Include your account email and repository name when the issue is account-specific.
The demo shows the product shape without connecting a real repository.