Getting started

DesSecurity scans a GitHub repository, maps how its files depend on outside packages, finds known vulnerabilities, leaked secrets and Risky APIs, and shows you which ones matter most. There is nothing to install: you give it a repository, and it reads the code without ever running it.

Sign in

You need an account to run scans and keep their results.

  1. 1
    On the home page, click Scan Your Repository, or open the Dashboard from the top bar.
  2. 2
    Sign in with GitHub, or with your email address and a password.
info
Signing in with GitHub is the quickest way to scan private repositories, because your repositories appear in the scanner straight away. You can also connect GitHub later.

Connect GitHub

Public repositories can be scanned by URL without connecting anything. Connect GitHub when you want to pick from your own repositories or scan private ones.

  1. 1
    Open the scanner: click New Scan in the dashboard, or go to /scan.
  2. 2
    If you did not sign in with GitHub, find the Want to scan private repos? box and click Authorize GitHub.
  3. 3
    Approve access on GitHub. You return to the scanner, and your repositories load under My Repositories. If they don't appear, click Already connected? Refresh.

If you see Only public repos visible, your GitHub connection was approved without access to private repositories. Click Re-authorize GitHub in that banner and grant repository access.

info
GitHub describes this permission as read and write access to your repositories. DesSecurity only reads them: it downloads the files of the branch you choose and never writes to GitHub. Your GitHub token stays on our servers and is never sent to your browser.

Scan a public repository

  1. 1
    Open the scanner. If GitHub is connected, switch to the Any Public URL tab.
  2. 2
    Paste the repository address, for example https://github.com/pallets/flask. It must start with https://github.com/. You can also click one of the examples under Try a popular open-source project.
  3. 3
    Answer Is this scan for a production or staging deployment? by choosing Production or Staging. This is required, because it changes the risk score: the same vulnerability is more urgent in production.
  4. 4
    Click Start Analysis.

The report page opens and shows each stage as it runs:

  • Queued: waiting for a free scanner.
  • Downloading & Parsing: the repository is downloaded and its files and package manifests are read.
  • Scanning CVEs: each package version is checked against public vulnerability databases.
  • Scanning for Leaked Secrets: the files are checked for keys, tokens and passwords.
  • Analysis Complete: the report appears.

Most repositories finish in under a few minutes. Large repositories take longer.

Scan your own repositories

  1. 1
    In the scanner, stay on the My Repositories tab. Use the search box to find a repository by name. Private repositories show a Private label.
  2. 2
    Click the repository to select it. Its default branch is chosen for you; use the branch menu on the repository to scan a different branch.
  3. 3
    Choose Production or Staging, then click Start Analysis.

To pick up repositories you created recently, click Refresh above the list.

What gets scanned

  • Languages: Python, JavaScript and TypeScript, Go, Rust, C, C++, C#, Java and Ruby.
  • Dependencies: the package manifests and lock files in the repository, with the versions they declare.
  • Secrets: every file in the scanned branch. Earlier commits in git history are not checked.
  • Source: GitHub repositories only.
lightbulb
Your code is never executed. It is downloaded to a temporary folder, read, and deleted as soon as the scan ends. Only the results are kept. See the Privacy Policy for details.