Production-readiness scan for public GitHub repos
Find out if your repo is ready for production.
Paste a public GitHub URL. CodeClanker checks the repository, scores nine dimensions, and tells you exactly what it did and did not inspect. About two minutes. No signup.
Read-only · nothing in your repository is executed · the report states its own coverage
See a real report before you scan.
Every published scan is a permanent page with its score, its findings and a statement of what was checked. Read one before you run your own.
Browse public scansWorkable, with significant gaps to close.
- CriticalHardcoded API key committed to the repositorysrc/config/payments.js
- HighNo authentication on the admin routesserver/routes/admin.js
- MediumNo automated tests run in CI.github/workflows/
PARTIAL Only 38 key files could be read for secrets.
Nine dimensions, each scored 0 to 100.
| # | Dimension | What it looks at | Measured by |
|---|---|---|---|
| 01 | Code quality | Dead code, duplication, type safety, naming consistency, dangerous patterns, lint gaps. | ESLint · complexity metrics |
| 02 | QA & testing | Test coverage, critical-path coverage, flaky tests, missing edge cases, no-test-at-all reality checks. | Test file detection |
| 03 | Security | Auth gaps, exposed secrets, input validation, SQL/NoSQL injection, OWASP top 10, leaky API routes. | Secret scan · OSV.dev |
| 04 | Maintainability | Module boundaries, cyclomatic complexity, file size, documentation, "what does this even do" smell. | Model assessment, bounded by evidence |
| 05 | Observability | Logs, metrics, traces, error tracking, alerting, SLO readiness. Can you tell something's broken before users do? | Model assessment, bounded by evidence |
| 06 | Performance & scale | N+1 queries, missing indexes, blocking I/O, bundle size, caching strategy, what dies at 10× traffic. | Model assessment, bounded by evidence |
| 07 | Architecture & tech debt | Coupling, layering, state management, leaky abstractions, what to refactor before it's a rewrite. | Model assessment, bounded by evidence |
| 08 | DevOps & CI/CD | Build pipeline, deploy reliability, environment parity, rollback story, secret management, branch hygiene. | CI detection · deploy readiness |
| 09 | Cost & infra waste | Idle resources, oversized instances, untuned databases, unnecessary third-party SaaS, the bill at 100× scale. | Model assessment, bounded by evidence |
How a scan works, and what it will not claim.
Paste a public GitHub URL.
No signup, no install, no card.
Deterministic checks run first.
Committed secrets, dependencies against OSV.dev, deploy readiness and code quality. Then nine dimensions are scored.
Open the report.
A summary, plus a page each for code, security, dependencies, deploy readiness, tests and infrastructure.
The coverage promise
- Every check records how much it inspected, and the report says so.
- Partial means partial. If only key files could be read, that is stated.
- If the vulnerability database cannot be reached, the repository is reported as unverified, never as clean.
- Nothing in your repository is executed.
- Sample apps, examples and docs are not counted as what you ship.
Questions.
Will you have access to my code? Is it safe?
Read-only access only — to a temporary user we ask you to revoke after delivery. NDAs available on request. We do not train on your code, share it, or keep copies after the audit closes. Encrypted at rest, deleted within 30 days.
What stacks do you support?
Anything mainstream: Next.js, React, Vue, SvelteKit, Remix, Node, Python (Django/FastAPI/Flask), Go, Ruby on Rails, plus typical stacks around Supabase, Postgres, Redis, Vercel, Render, AWS, GCP. If you're on something exotic, ask — we'll tell you honestly whether we're the right fit.
How long does it take?
The free automated scan usually finishes in a couple of minutes. If you want a human audit afterward, that engagement typically takes three to five business days.
Do you fix the issues, or just point them out?
The free scan points to the highest-risk areas and evidence paths. For deeper remediation planning or implementation support, we offer a paid human audit and follow-up work.
What does it cost?
It depends on codebase size, stack complexity, and turnaround. Every engagement starts with a free scan and a transparent quote — no commitment until you've seen what we're going to deliver.
What's a "free scan"?
An automated pass that scores all nine dimensions and opens a multi-page report in your browser, usually within a couple of minutes. It is enough to expose top risks before you decide on a deeper human audit.
Need a human to go deeper?
A paid audit by a person: a full read of the codebase and a remediation plan. Typically three to five business days. Start with the free scan; this is for when you want more than it can tell you.
- A full read of the codebase by a person
- A remediation plan ordered by risk
- Three to five business days from start to delivery
Got it. We're on it.
We have your details and will be in touch about the audit. To get an instant automated report right now, paste a public GitHub repository URL in the form at the top of this page.