TECHSCAN · Air-gapped code risk assessment

Do you know what's really
inside your company's code?

Open-source license conflicts, hardcoded passwords, unpatched vulnerabilities — real code audits find them in most codebases. And in most cases, the CEO had no idea.

Found in real code audits: license conflicts 94% · unpatched vulnerabilities 97% · Black Duck audit data

Assess my code · from $119View sample report
  • Zero source code leaves our network
  • Air-gapped analysis
  • Report within 24 hours
  • Source deleted after analysis

WHEN IT MATTERS

Sooner or later, someone opens your code

  • Investor due diligenceBefore they look
  • Accepting outsourced deliverablesIs the code you received sound?
  • Pre-launch reviewBefore an incident happens
  • M&A or enterprise vendor reviewFind the deal-breakers first
  • Right after a security incidentIs there more like it?

— If that's the first time you look, it's already too late.

01 — SECURITY RISK

Passwords in your code, forgotten backdoors

These creep in naturally during development, and they stay hidden unless someone goes looking for them.

Credentials left in code

API keys and database passwords written directly into the code. Even if you think you deleted them, they remain in your git history.

Evidence · working tree + full git history

Publicly known vulnerabilities

We check whether you use library versions with publicly documented exploits. After an incident, the verdict becomes “you could have known.”

Evidence · cross-checked by two scanners (Trivy, Grype)

Risky code paths and backdoors

We look for bypass access left behind by former employees, and for places where external input is processed without validation.

Evidence · file and line locations (semgrep)

02 — LICENSE RISK

One open-source package can put your entire codebase up for disclosure

GPL or AGPL code mixed into a core module can trigger source disclosure obligations or a full rewrite. In production, that means license violation notices; in enterprise vendor reviews, a rejection; in investment or M&A due diligence, a deal-breaker.

It isn't anyone's fault — it's simply invisible. It starts with one line pulling in a library you needed, and it stays hidden unless you look for it.

Pass · Permissive licenseFail · Strong copyleftEvidence · component / license / file path

03 — AI CODING BLIND SPOT

Nobody knows where AI-generated code came from

Generated code comes with no license notice and no dependency list. That's why traditional checks that only read package manifests can come back “clean.” As development speeds up, so does what you need to verify.

16%Share of open-source components identified in real audits that came in outside the package manifest (copied code, Stack Overflow, AI snippets) · Black Duck audit data

04 — WHAT YOU GET

Here's what you get

A one-page summary for the CEO, and a file- and line-level list your dev team can fix from directly. Both audiences, in one document.

Cover — overall risk grade · issue date · scan scope
Executive summary — severity distribution · coverage by scan area · top 3 priority actions
Details — verdicts by item with file and line evidence, and fix guidance

05 — HOW IT WORKS

From source upload to fix guidance, in three steps

01About 5 min

Upload source

Upload a ZIP file or connect a read-only git or svn repository.

02

Full air-gapped analysis

We scan everything — SBOM, licenses, credentials, vulnerabilities, and code paths — with nothing sent outside. (No one can view your source code. 100× compensation if your code ever leaks through our system.)

03Within 24 hours

Verdict report

A one-page summary for the CEO and a file- and line-level list your dev team can use as is, in the same document.

06 — DATA SOVEREIGNTY

“You want me to hand over our entire source code?”

An NDA, built into the architecture

We protect your code by design, not by promise. Source is analyzed only in an environment cut off from the outside, deleted automatically by policy once analysis ends, and the deletion is recorded as evidence.

Zero data sent to external LLMs

Automatic source deletion + deletion certificate

Per-organization access isolation · audit logs

07 — WHY TECHSCAN

There are roughly five ways to check your code

  • Do nothing

    The most common choice. Problems usually surface when someone else opens the code.

  • Have your developers run free scanners

    Each tool gives different results, and the output is a list for developers — not a document a CEO can read and act on.

  • Apply for a free public program

    Public programs offer free license and open-source vulnerability checks. But you must submit your source code to the agency, application, review, and waiting take weeks, and eligibility and frequency are limited.

  • Buy a commercial security tool

    Annual subscriptions, per-seat pricing, CI integration, and policy setup. Great for ongoing use, but heavy when you just want “one look, now.”

  • TechScan

    Choose the scope you need and pay per assessment.

Your whole codebase, not just licenses

Beyond open-source licenses, we check credentials left in code, git history, and risky code paths — all at once.

Cross-checked, not a single tool

We compare results from multiple tools to correct for the false positives and misses of any single scanner.

Two audiences, not just developers

A summary for the CEO and evidence for the dev team, in one document.

A document you can submit, not a dashboard

Every verdict comes with file and line evidence, and each report carries a verification hash.

08 — TECHSCAN PLANS

Inspection catalog

Choose the scope you need and pay per assessment.

Security Triple Check

Individual

Security Triple Check

Risk removed

Finds and blocks the risk of leaked secret keys, vulnerable open-source and security flaws reaching production and turning into a breach.

  • Exposed secrets
  • Dependency vulnerabilities
  • Static security analysis
Launch price $149 $119

Ends Dec 4, 2026 (Korea time)

Final price in USD. Local taxes are your responsibility.

Order assessment

Free readiness check

File contents are not transmitted. Only filenames are matched on the server; only slot results are stored.

Cuts the risk of spending money on the wrong checks first, with a free self-assessment.

Free readiness check

Monthly Security Monitoring

$39

Final price in USD. Local taxes are your responsibility.

Don't stop at a single assessment — get alerted every month to newly exposed secrets and vulnerabilities.

Guards against missing newly disclosed vulnerabilities and leaks, with an automatic monthly check.

Subscribe to monitoring

Credit Pack

$400

Final price in USD. Local taxes are your responsibility.

Planning to check several repositories? Top up a credit pack in advance and earn a bonus.

Replaces paying each time with pre-loaded credits (plus a bonus), keeping budget in one place.

Top up credits

09 — FAQ

Frequently asked questions

How is this different from free or commercial security tools?

There's nothing to deploy or subscribe to — use it once, when you need it. The output isn't a dashboard but a single report: a summary for the CEO and file- and line-level evidence your dev team can act on, in one document. Analysis runs in an air-gapped environment, so your source never leaves. This doesn't mean our detection scope or accuracy beats specialist tools — the difference is how you use it.

Could my source code leak?

Your source is processed only in an isolated, air-gapped analysis environment and is never sent to external AI. Scans run automatically with no human viewing the code, and once the assessment is complete we delete the source and keep an audit trail. If it is technically proven that source code leaked from inside our system, we will compensate you 100× the amount you paid (see Article 9-2 of the Terms of Service for conditions and exclusions).

Can I understand it if I'm not a developer?

The one-page CEO summary covers business impact and top-priority actions, while the dev team section separately provides the SBOM, file and line locations, and fix guidance.

Can I assess code delivered by an outsourcing vendor?

Yes, if delivery is complete and your company owns the code. However, TechScan is only for self-assessing your own company's code; you may not upload another company's code (a pledge is required when you apply). To verify the code of a company you're investing in or acquiring, please use TechDD Pro for enterprises.

Isn't there a free government program for this?

Yes. Public programs offer free open-source license and vulnerability checks, and if you qualify, they're a good option. TechScan differs in three ways: ① you don't submit your source code to an outside agency; ② there's no application or review, and you get results within 24 hours; ③ beyond licenses, we also check credentials left in code, git history, and risky code paths.

How long does it take?

We issue the report within 24 hours of your source upload.

Can I get a refund?

A full refund is available before the analysis runs. Refunds are limited once the analysis has started.

10 — FOR INVESTORS & ACQUIRERS

Are you an investor or acquirer?

For deals that need a full-scope analysis with review and sign-off by a CTO-level expert, we offer TechDD Pro.

Explore enterprise due diligence