Questions

No. Scanning reads files and never builds, installs or executes anything from your repository — no npm install, so no postinstall script ever runs on our machines.

That is not a limitation we are apologising for; it is the boundary the whole service rests on. We hold other people’s repository tokens, and a service that executes untrusted code alongside them is one bad repository away from a very bad day.

Nowhere, for a Security Check. The scanners run on an ephemeral worker, read your files, and the worker is destroyed.

AI Review — bundled automatically onto a paid scan once it finishes — never touches your source either. It reads the findings that scan already produced, sent to Anthropic, and returns false-positive analysis, risk order and a fix prompt.

The credential scan runs first, and anything it matches is masked before a single byte reaches an AI provider. Files that exist only to hold credentials are never sent at all, whatever the scan found.

The ordering matters more than it sounds. Run it the other way around and our own finding — a live key committed to your repo — becomes the mechanism that leaks it to a third party.

No, and we will never word it that way. A clean report means nothing blocking was found, by these tools, on that commit.

Static analysis finds what it has rules for. AI Review adds judgement on top of what a scan already found — flagging likely false positives and prioritising the rest — but neither a scan nor a review is proof of absence. Anyone selling you the other answer is selling you something.

Neither, on purpose — once a check has been AI-Reviewed. You get the fix stated as an instruction, carrying the file, the symbol, the rule that fired and the constraint the fix has to satisfy — written to be pasted into the assistant that wrote the code in the first place.

It already has your repository open and your conventions in context. Handing it the intent beats us pushing a branch you then have to audit — which would put you back where you started, reviewing code you did not write.

No. Doing it properly means evaluating a rendered page — computed contrast, focus order, ARIA against the accessibility tree — and none of that exists in source code.

Getting real results would mean building and serving your repository inside our runner, which is exactly the thing we refuse to do. The alternative was linting templates and calling a thin subset "WCAG compliance". Neither trade was worth it, so we do not offer it here.

It has its own home instead — audit.codexmotive.com — built to do it properly against a running application. Two tools because it is two boundaries: the thing that makes this one safe to point at a private repository is the same thing that makes accessibility testing impossible inside it.

Your first Security Check. Unlimited repositories, plain-language findings, and a launch verdict — no card, no API key of your own to set up. It runs scanners only; every Security Check you buy after it comes with an AI Review of what it found, bundled in, up to your plan's AI Review allowance.

Every Security Check after the first is metered — this changed from an earlier version of this product, which deliberately did not meter scans at all. That reasoning held while a scan cost us a container and two minutes and nothing else; it stopped holding the moment the product started selling checks directly, because an unmetered good cannot be a paid one.

A monthly allowance of Security Checks, most of them with AI Review bundled in, cheaper per unit than buying packs one-off — see the pricing page for the exact math. Nothing about what a scan finds changes; every plan runs the same scanners.

AI Review is what actually finds the class of problem that takes a new app down: authorisation enforced only in the browser, database rules that let any signed-in user read anyone’s row, payment webhooks nobody verifies — findings a scan already returns, that AI Review re-reads for false positives and puts in risk order with a copy/paste fix.

A Security Check is a scan — the scanners read your files and return every finding they produce, plain-language. On its own, it never produces false-positive analysis, a risk order across findings, or fix prompts. It is what your first, free check already gives you in full.

An AI Review reads that same scan's findings — not your source code — and returns which ones look like false positives, which order to fix the rest in, and one combined prompt for your coding agent. It runs automatically once a paid Security Check finishes, whenever your plan bundles one in; there is nothing extra to ask for or buy. One review covers one whole scan, never one finding.

Yes, for what you have not used. A Security Check or AI Review you paid for and never spent — from a pack or from a Pro allowance — is refundable if you ask within 14 days of paying for it.

Pro specifically: cancel within 14 days of first subscribing and the unused part of that period is refunded the same way. After that, a renewal charge you have used nothing from is refunded in full within 14 days of it; use any part of a renewal period and that period stays paid — cancelling still stops every charge after it.

The projects, the scan history and the stored repository tokens are destroyed.

Yes. You supply an access token with read access, stored encrypted, and it is validated when you connect the project rather than failing later in the middle of a scan.

Deleting the project destroys the token.