What it does
Quick Scan First reads the GitHub repository you choose, using a fine-grained token that you control. Built-in checks look for committed .env files, possible secrets and unsafe database rules. They also check supported npm lockfiles against OSV.dev. With Pro or credits, an AI review investigates likely authentication, ownership and payment mistakes. You can copy a fix prompt or request an AI-assisted pull request. Each fix is a pull request on a new branch. Nothing changes until you review and merge it. You inspect the diff on GitHub. The token needs read and write access to Contents and Pull requests. Quick Scan First says code is read during a scan and is not saved on its servers. It says relevant files are sent to Anthropic only when an AI review or fix needs them.
Capabilities
- Every scan checks for hardcoded API keys and private keys.
- Every scan checks for open Firebase and Supabase access and missing repository safeguards.
- With Pro or credits, the AI review also looks for webhook implementation mistakes.
- With Pro or credits, the AI review also looks for crashes across important user paths, data exposure and broken configuration, with evidence linked directly to your source code.
- Private repositories work when your fine-grained token has access to them.
When to use it
- You want a review of a GitHub repository before launch.
- You want to investigate Stripe webhook signatures, server-side payment checks and ownership mistakes before launching a paid app.
- You want to check supported npm package-lock files against OSV.dev for known vulnerabilities before launch.
