Individual
Security Triple Check
Risk removed
Finds and blocks the risk of leaked secret keys, vulnerable open-source and security flaws reaching production and turning into a breach.
Ends Dec 4, 2026 (Korea time)
Final price in USD. Local taxes are your responsibility.
Inspection scope
- Exposed secrets
- Dependency vulnerabilities
- Static security analysis
Evidence, remediation guidance and a digitally signed PDF for the selected scope
Within 24 hours after submission
Required evidence
- Source repository or ZIP
Full refund before analysis starts; after it starts, no refund for change of mind (full refund if we fail to issue the report within the turnaround time for reasons on our side).
Who this is for
- Teams that want to close the security gaps left in their code before launching a service
- Companies that have had a security incident and want to check whether the same problem exists elsewhere in the code
- Situations where developers have changed or left, and no one knows what remains in the code
What we check, and how
- Secrets and credentials left in codeWe look for API keys and database passwords written into the code. Values you thought were deleted remain in git history, so we scan both the working tree and the full git history (gitleaks).
- Publicly known vulnerabilities (CVE)We check whether you use open source versions with publicly disclosed exploits. To reduce the misses and false positives of any single tool, we cross-check the results of two scanners (Trivy, Grype).
- Risky code flowsWe locate security flaws, such as points that process external input without validation and paths that bypass access controls, down to the file and line (semgrep).
What the report includes
- A one-page summary for the CEO (risk ratings and priorities)
- A list for the development team: file path, line number, evidence and fix guidance for each item
- A digitally signed PDF with an authenticity-check hash
How it works
- Upload source code (about 5 minutes): a ZIP file or a read-only git or svn repository
- Full analysis in a closed network, with no external transfer
- Within 24 hours after submission: report issued
- 1 free rescan(s) within 30 days after you fix the issues, comparing what was resolved, what remains and what is new
Frequently asked questions
How is this different from our developers running free scanners themselves?
Each tool produces different results, and the output is a developer list, not a document a CEO can base decisions on. The Security Triple Check reconciles the results of multiple tools and gives you a CEO summary and evidence for the development team in a single document.
Do you find passwords that were already deleted?
Yes. We scan the full git history, not just the current code, so values left in commit history are found as well.
Is it safe to hand over our source code?
Source code is analyzed only in an isolated, closed-network environment and is never sent to an external LLM. Submitted source ZIPs, repository links and read-only tokens are automatically deleted once the assessment is complete, and the deletion is logged as evidence. If source code leaks through our system, we compensate 100 times the amount paid for that assessment (Terms of Service).
What do we receive?
A digitally signed PDF report that combines a one-page summary for the CEO with file- and line-level evidence your development team can act on directly. The report carries an authenticity-check hash, so it can be submitted to third parties.
Can we get a refund?
You receive a full refund before analysis starts. Once analysis has started, refunds are not available for a change of mind, but you receive a full refund if we fail to issue the report within the turnaround time for reasons on our side.