New scan

Configure and launch a security scan

This is a demo — scans are disabled.

This is a read-only scan example. Scheduling and SARIF import require an account; these controls do not schedule a job or upload a report.

Target & mode

Scan mode

Target URL

Public targets only — private/loopback IPs, localhost, and link-local addresses are blocked (SSRF protection).

Source code

Public or private repository URL. The backend clones it before scanning.

Branch (optional)

Access token (private repos)

For private repos, provide a Personal access token with repo scope. Encrypted at rest, never logged.

Use pip-audit for Python deps

Shell out to the pip-audit binary instead of the native OSV.dev client. Useful when your environment audits subprocess calls or you need pip-audit-specific patches ahead of OSV.dev's index. Falls back to OSV.dev silently if pip-audit isn't on PATH.

Discovery & authentication

OpenAPI spec (optional)

Local path or HTTP(S) URL. In v3.7.0 the optional Python analyzer refetches HTTPS URLs under a separate policy and rejects HTTP; use a local file when requiring that phase.

Auth token (optional)

Credentials may be encrypted at rest while queued for execution and are removed after completion. Do not place secrets in log messages.

Output & gating

Fail on severity

Active injection probing

Sends injection payloads to test for SQLi, command injection, and header injection. Only use against systems you own or have written authorization to test.