Start free. Scale when you need to.
All 37 vulnerability categories on every plan.
Free
For solo developers exploring AI-generated code risks.
- Public repos only
- 10 PR scans per month
- 1 security sweep (lifetime)
- Rescan available, counts as a new scan
- Slack & email alerts
- Dashboard access
Starter
For solo developers who need private repo coverage.
- Public + private repos
- 50 PR scans per month
- 1 security sweep per month
- Auto-rescan on PR update (small clean updates skipped)
- Slack & email alerts
- Dashboard access
Pro
For teams needing full coverage, merge blocking, and higher quotas.
- Public + private repos
- 500 PR scans per month
- 10 security sweeps per month
- Auto-rescan on PR update
- Slack & email alerts
- Dashboard access
- GitHub merge blocking (check runs)
Cancel anytime · Payments by Paddle
Merge blocking on private repos needs a GitHub Team org or higher.
Questions
Does it work with private repos?
Yes, on Starter and Pro. Free covers public repos.
What counts as a PR scan?
Each analysis of a pull request diff, rescans included. If a scan fails on our side, the credit is refunded and the scan is marked failed, never clean.
What is a security sweep?
A deep review of your recent default-branch history. It builds a threat model and finds attack chains that span several commits, which a single-PR scan can't see. Run one after a big refactor or before a launch.
Do unused scans roll over?
No. Paid quotas reset on your billing date, Free on the 1st of each month.
Can I cancel anytime?
Yes, from the billing dashboard. No lock-in.
How does merge blocking work?
On Pro, Gitsentry sets up branch protection and adds a GitHub check to every PR. If it finds issues, the check fails and the PR can't merge. For private repos, GitHub only enforces this on Team plans or higher; a free GitHub org shows the check but won't block.
What does it scan for?
37 vulnerability categories on every plan, from SQL injection and IDOR to SSRF, race conditions, and prompt injection. Categories that can't apply to your project type are skipped.
What about false positives?
A second pass tries to disprove every finding before it's posted, and credential formats are matched by exact rules. Dismiss a category twice in a repo and Gitsentry needs stronger proof before raising it there again.
Is it really free for open source?
Yes. Public repos get 10 PR scans a month and one trial sweep, at no cost.
Free for open source. Forever.
No credit card. No config.
Install GitHub App, it's free →