Free Scan
Every Project gets a free static-analysis scan. It needs no credits and no card. Point a project at a repository, start a scan, and you get SAST findings, dependency and licence data, exposed secrets, infrastructure misconfigurations, an SBOM and a call graph.
How it works
- You attach a source to a project — a repository from a connected integration, a public repository URL, or an uploaded archive.
- You start the scan. AISafe fetches the source, analyses it in an isolated sandbox, and publishes the results.
- AISafe deletes the source. The results stay.
A scan usually takes a couple of minutes.
We delete your source after every scan
When a scan ends, AISafe removes every copy of the source code it fetched, from every place it was stored. This happens whether the scan succeeded or failed.
The results survive, because they do not contain your code. AISafe's static analysis produces a source-free snapshot: typed facts, file paths, line locations, dependency metadata and redacted secret fingerprints. It never keeps raw source or raw secret values. That is why the findings page still works after the source is gone.
For a scan of a connected or public repository, a rescan simply fetches the source again. For a project whose source you uploaded, there is no upstream to re-fetch from, so a rescan asks you to upload the archive again.
See Data handling for how the rest of your data is stored.
How often you can scan
Rescans are limited per project so a scan cannot be started in a loop:
| Plan | Rescan window |
|---|---|
| Basic (free) | one scan per project every 3 days |
| Pro | on demand, with a 10-minute anti-thrash gap |
| Enterprise | on demand |
If you ask for a scan inside the window, AISafe tells you exactly when the next one is available rather than failing silently. Upgrading takes effect at once: if you go Pro during a free-tier window, you can scan immediately.
One scan runs at a time per organization.
What changed since last time
From the second scan of a project onward, the results page reports what is new and what is resolved compared with the previous scan.
The comparison ignores line and byte positions, so reformatting a file or adding a comment at the top does not flood the report with false movement. Only genuine appearances and disappearances count.
The first scan of a project has nothing to compare against and is shown as a baseline.
What the free scan does not include
The free scan is deterministic static analysis. It does not run the AI audit that reasons about your architecture, chains findings into attack paths, or proves exploitability. Those are Code Audit and Pentest, which any organization — free or Pro — can run by buying credits. Plans never gate them.