Your prototype runs.Production asks for more.
Produtype reads a repository and reports what is missing before it can carry real users — judged as the kind of product it is meant to be, not as code in general. A B2B SaaS is held to tenant isolation and audit trails; a static site is not.
No account needed to scan a public repository.
This repository, scored as a…
What it is missing, in order — the first 3 of 5
- Multi-factor authentication (recommended)
- Role model (required)
- Consent capture (recommended)
Nothing in the code changes between these numbers. A marketplace needs payouts and two sides of a transaction; a static site needs neither, and is not marked down for missing them.
How a scan works
Four steps, none of which involve a model deciding what your code is worth.
- 01You point it at a repositoryA public GitHub URL, or a private one once the app is installed. It is cloned into a temporary directory, read, and the clone is deleted when the scan ends — nothing downloaded is kept, so scanning again downloads again.
- 02It reads what is thereManifests and source, across JavaScript, Python, PHP, Go, Ruby and .NET: the frameworks, the data layer, how sessions work, what is uploaded, what is logged. Every signal is found in the files themselves — nothing is asked of a model, so the same commit always gives the same reading.See everything it reads →
- 03It decides what kind of product it isA B2B SaaS, a consumer app, a game, a tool that runs in the browser. This is the part that matters: the kind of product decides what it is held to. Where the evidence does not settle it, the report says so instead of guessing.
- 04It scores the gap, and names itWhat that kind of product needs, minus what the repository has. Every point traces back to a rule and a file you can open and argue with.
as a B2B SaaS
0
0 critical · 0 high · 4 medium
It reads what is there
The stack, the data layer, how the app is served. Every signal is found in the repository rather than asked of a model, so the same commit always gives the same reading.
It asks what this kind of product needs
A B2B SaaS is held to tenant isolation, an audit trail and a way to erase someone's data. A static site is held to none of them, and is not marked down for missing them.
The difference is the number
What the product needs, minus what the repository has. Every point traces back to a rule and a file you can open.
What you get back
A number, the gap behind it, and the order to close it in.
- A score you can argue with
- Every point comes from a rule and a file. The same commit always gives the same number — nothing here asks a model what it thinks.
- The gap, named
- Not 'improve security'. Which capability is missing, what a reviewer would expect to see, and where it would go.
- An ordered plan
- Tasks sorted so that nothing depends on something further down the list, with effort and risk on each.
What a report says
Not an example. This site, scanned by the analyzer it ships, before this page was built.
94/100
as a B2B SaaS · 12 checks passed · 5 still open
- MediumMulti-factor authentication (recommended)auth · missing
- MediumRole model (required)authz · partial
- MediumConsent capture (recommended)gdpr · missing
- MediumDeployment readiness (required)deployment · partial
- LowDeployment readiness baselinedeployment · partial
That is the real list for this site, in the order the report gives it. We publish what this repository actually scores, including what it has not fixed — a tool that measures production readiness and reports itself flawless is telling you something about its scoring, not about its code.
How the score is built →What it costs
The analyzer is free and open source. This is what the hosted version asks for.
The analyzer itself is open source and free forever — it runs on your machine and sends nothing anywhere. This site is what you pay for when you want it hosted, tracked over time, and reviewed by a model.
What happens to your code
- The clone is deleted when the scan ends
- It is read from a temporary directory and removed as the last step. Scanning the same repository again clones it again — nothing is kept to make that faster.
- Read-only, always
- Nothing is written to your repository: no branches, no commits, no issues, no pull requests. The GitHub App asks for read access and nothing else.
- The report is yours
- What is stored is the report — scores, findings, the files they point at. If you ask for the optional AI review, secrets are redacted before anything is sent, and the review never changes the score.
Point it at a repository.See what production would ask of it.
No account needed. 10 scans a month stay free.