Free Scan

A free static-analysis scan needs no credits and no card. Point AISafe at a repository and you get static-analysis issues, dependency and licence data, exposed secrets, infrastructure misconfigurations, an SBOM and a call graph.

A scan usually takes a couple of minutes.

Two ways to start one

Without a project. Choose the free scan when starting new work, paste a public repository URL, and the scan runs. Nothing else to set up. Your plan includes a number of these each month; the free plan includes 15, and the count returns to zero at the start of each calendar month. A scan that fails before AISafe reads any code does not count against it.

From a Project. Attach a source once — a repository from a connected integration, a public repository URL, or an uploaded archive — and scan it whenever you like, subject to the per-project rescan window below.

The fastest way in is the Create project & scan button on your dashboard. It opens a card in place: pick the repository or upload an archive, narrow the scope if you want to, and the project is created and the scan started without leaving the page. Results appear in the same card as they arrive.

A project is what you want for code you keep working on. It carries scheduled scans, monitoring, and the comparison that tells you what is new and what you have resolved since the last run. A scan without one is a single look.

The rescan window on a project

A project can be rescanned every three days on the free plan, and every ten minutes on Pro. The window is per project, so scanning one does not hold up another.

How long AISafe keeps your code

AISafe keeps the code it analyses for 30 days, then deletes it. Two clocks, because a scan and a project are different things:

What	When it is deleted
The snapshot one scan analysed	30 days after the scan attached it. This clock never resets — a snapshot is one moment in time.
Your project's source	30 days after the last activity on the project. This clock resets every time you use it.

A project with a scan schedule or monitoring turned on is never affected: you have told AISafe you want the work to keep happening, so the source stays.

You can also delete an assessment's source yourself at any time, from the assessment's tool panel.

Results survive the deletion. They do not contain your code. AISafe's static analysis produces a source-free snapshot: typed facts, file paths, line locations, dependency metadata and redacted secret fingerprints. It never keeps raw source or raw secret values. Findings, severity counts and the SBOM stay readable indefinitely. What stops working is the Code Explorer, which reads the code itself.

Rescanning after the source is gone depends on where it came from. A connected or public repository is fetched again, so a rescan just works. A project whose source you uploaded has no upstream, so AISafe asks you to upload the archive again — and tells you before you get there.

See Data handling for how the rest of your data is stored.

How often you can scan

Rescans are limited per project so a scan cannot be started in a loop:

Plan	Rescan window
Basic (free)	one scan per project every 3 days
Pro	on demand, with a 10-minute anti-thrash gap
Enterprise	on demand

If you ask for a scan inside the window, AISafe tells you exactly when the next one is available rather than failing silently. Upgrading takes effect at once: if you go Pro during a free-tier window, you can scan immediately.

One scan runs at a time per organization.

Reading the results

Issues first. Everything the scan can rank sits on one table: rules matched in your source, advisories against your dependencies, packages past end of life or under a licence your policy refuses, credentials found in a file, and infrastructure checks that failed. One list, worst first, whatever found it.

An issue is not a finding. A scan matched a pattern; a finding is something your team has decided to carry. On the Issues tab you can promote an issue into an ordinary finding, which puts it in your findings list with everything else and gives it a code you can quote. You can also mark one a false positive or an accepted risk, which closes it without creating a finding — it stays out of your findings list, your counts and your SLA clock, and the decision survives the next scan of the same project.

The tabs after Issues are inventories: dependencies, secrets, infrastructure, licences and endpoints. They show what the scan found and offer no buttons. Deciding what to do about something happens in one place.

Every number on the page counts the same population as the list under it.

What changed since last time

From the second scan of a project onward, the results page reports what is new and what is resolved compared with the previous scan.

The comparison ignores line and byte positions, so reformatting a file or adding a comment at the top does not flood the report with false movement. Only genuine appearances and disappearances count.

The first scan of a project has nothing to compare against and is shown as a baseline.

Export the results

Call GET /api/v1/assessments/{id}/sast-findings/export?format=sarif|csv with the findings:export scope to download the scan's immutable static-analysis results. SARIF works with code-scanning tools; CSV contains rule, severity, message, location, classification, confidence, reachability, and remediation columns. Repeat the fingerprints query parameter to export selected result groups.

What the free scan does not include

The free scan is deterministic static analysis. It does not run the AI audit that reasons about your architecture or proves exploitability. Those are Code Audit and Pentest, which any organization — free or Pro — can run by buying credits. Plans never gate them.