Start free. Scale when you need to.

Does it work with private repos?

Yes, Starter and Pro plans include private repository access. The Free plan is limited to public repos.

What counts as a PR scan?

Each time Gitsentry.dev analyzes a pull request diff, that's one scan. Rescans, whether from the dashboard button or the '/gitsentry rescan' comment command, each count as one scan against your monthly quota. A scan that fails on our side costs you nothing: we refund the credit and label the scan as failed rather than showing it as clean.

What is a security sweep?

A PR scan reads one diff in isolation. A sweep reads your recent history on the default branch as one body of work: an adversarial review that defines attacker profiles, entry points, and trust boundaries, then hunts for chained attack paths that span several commits. You get a threat model and named attack chains, not just a finding list. Sweeps run on a stronger model than PR scans. Run one after a large refactor or before a launch.

Will my Pro scans roll over?

No. Scan and sweep quotas reset on your billing date each month. They don't roll over, but 500 scans covers most teams of up to 20 engineers with room to spare.

Can I cancel anytime?

Yes. You can cancel or manage your subscription at any time from the billing dashboard. No lock-in.

How does merge blocking work?

On the Pro plan, Gitsentry.dev automatically sets up branch protection and posts a GitHub Check Run on every PR. No manual configuration needed. If any security issues are found, the check fails and GitHub requires it to pass before merging. For private repos, enforcement requires your GitHub organization to be on the GitHub Team plan or higher.

How many vulnerability categories does it cover?

37, on every plan. PR scans and sweeps draw on the same set, from SQL injection and IDOR through to SSRF, mass assignment, race conditions, and prompt injection in LLM call sites. Gitsentry drops the categories that can't apply to your project type before the scan runs, so a static frontend never gets asked about SQL injection.

What about false positives?

Every finding goes through a second AI pass that re-reads your diff and tries to disprove it; anything it can't prove gets dropped before the comment is posted. Well-known credential formats are matched by pattern rules instead, which never hallucinate. And when you dismiss a category as a false positive twice in one repo, Gitsentry demands concrete evidence of an exploitable path before raising that category there again.

Is this really free for open source?

Yes. Public repos get 10 PR scans per month at no cost, forever. The free security sweep lets you run one full audit to see what the scanner can find.