GitHub security scanner
Scan any GitHub repo for what AI left behind
Paste a repo URL and Prbl finds the hardcoded keys, missing auth checks, injection and unverified tokens that AI coding tools ship, with the fix attached. Free for public repos, no account. Add the Action and every pull request gets the same review before it merges.
Three ways to run it
Drop a github.com URL into the scanner. It clones the repo, runs the 15 rules over the Python, JavaScript and TypeScript, and returns file, line, severity and the fix in about a minute. Try it on a repo you did not write; that is how we found most of what is in the study.
Sign in with GitHub and pick a repo. Your token is used to clone, never stored, never logged, and never written to a database. The clone is deleted after the scan; findings keep only file path, line number and rule.
Two lines in a workflow file. Findings appear as inline comments on the PR, updated on each push. Turn on fail-on-high and a serious finding blocks the merge.
# .github/workflows/prbl.yml
name: Prbl security scan
on: [push, pull_request]
permissions:
contents: read
pull-requests: write
jobs:
prbl:
runs-on: ubuntu-latest
steps:
- uses: Get-Prbl/prbl-action@v1
with:
api-key: ${{ secrets.PRBL_API_KEY }}
# fail-on-high: trueWhat it looks for
Fifteen rules, mapped to the OWASP Top 10, each one chosen because it showed up repeatedly when we scanned 2,148 AI-built repositories on GitHub: 976 linked from Hacker News, 628 generated by Lovable and Bolt, 544 web apps attributed to specific models. Hardcoded credentials were the top high-severity finding in every group. Path traversal, code injection, weak randomness and disabled TLS verification followed.
Full rule table on the SAST page; every rule links to a fix guide.
Prbl vs GitHub's built-in security
GitHub ships secret scanning, Dependabot and CodeQL. They are good, and the free ones should stay on. Here is where Prbl overlaps and where it adds something.
| Prbl | GitHub built-ins | |
|---|---|---|
| Secret scanning | Keys, tokens, passwords, signing secrets and fallback defaults in source; also keys in the deployed JavaScript | Push protection and alerts for known provider token formats; free on public repos |
| Code scanning | 15 rules for the flaws AI tools produce, tuned on 2,148 AI-built repos | CodeQL: deep semantic analysis, thousands of queries; free on public repos, Code Security licence on private |
| Dependencies | Hallucinated packages only | Dependabot: vulnerable and outdated dependencies, the reference tool |
| Missing authorization | Yes, a core rule; also probes the live app for routes that render without login | Partially, through CodeQL queries; not a first-class check |
| After the finding | Fix prompt per finding; rewriter applies and verifies | Copilot Autofix suggests fixes for many alerts |
| Setup | Paste a URL, or one workflow file | Enable in repo settings; CodeQL needs a workflow and a licence on private repos |
| Cost on private repos | Free Action; paid dashboard plans | GitHub Code Security, priced per active committer |
Head to head: Prbl vs GitHub Advanced Security · Prbl vs CodeQL.
Your code, and what we do with it
Cloned to our server, scanned there, deleted right after. No source is stored. Findings keep file path, line number and rule, nothing else. Secrets the scanner finds are never logged. For private repos, your GitHub token is used for the clone and is never stored, never logged, and never written to a database. Independent checks and the full pipeline are on the trust page.
Show it is clean
Repos running the Action can add a badge to the README that shows the current scan status to anyone who lands on the repo.
[](https://getprbl.com)
Frequently asked questions
Can I scan a GitHub repository for security vulnerabilities for free?
Yes. Paste any public repo URL into Prbl's scanner and you get findings with no account. The GitHub Action is also free and runs on every pull request. Private repos need a sign-in so the scanner can clone them, and the dashboard's paid plans add the rewriter that applies fixes.
Is this different from GitHub's built-in security features?
It overlaps in places and fills gaps in others. GitHub's secret scanning catches known token formats on push; Dependabot covers dependencies; CodeQL does deep analysis but on private repos needs a Code Security licence priced per committer. Prbl is tuned to the flaws AI coding tools actually produce, including missing authorization checks that none of the built-ins treat as a first-class finding, and it also checks the deployed app. Most people run Prbl alongside the free built-ins.
What happens to my code when you scan it?
It is cloned to our server, scanned there, and the clone is deleted immediately after. No source code is stored anywhere. Findings record only the file path, line number and rule that matched. Secrets found during scanning are not logged. For private repos, your GitHub token is used for the clone and is never stored, logged, or written to a database. The trust page has the full pipeline and independent third-party checks.
Which languages and frameworks does it scan?
Python, JavaScript and TypeScript, including Next.js, Express, Fastify, Flask, FastAPI and Django patterns. Repos in other languages are reported as unsupported rather than falsely marked clean. That coverage is deliberate: it is what Cursor, Claude Code, Copilot, Lovable, Bolt and v0 overwhelmingly generate.
I pushed an API key to a public repo. What now?
Rotate it immediately; scanners crawl public GitHub for keys continuously, so treat it as already read. Then remove it from the code and move it to an environment variable. Removing it from git history is worth doing but does not un-leak it; rotation is what makes you safe. There is a step-by-step guide linked below, and the scan will tell you if any other key is sitting in the repo.
Does the Action slow down my CI?
A scan of a typical app repo takes well under a minute and runs as its own job, so it does not sit in front of your tests. Comments are posted to the PR asynchronously and replaced on the next push rather than piling up.
Paste a GitHub URL. Findings with fixes in about a minute, no account.
Scan a repo →Guides: committed an API key to GitHub: the fix · what happens when you push a key to a public repo · remove a secret from git history · what we found scanning 976 Hacker News repos · AI code review · secret scanner