What is really in your repository?

Connect GitHub and get a score for secrets, vulnerable dependencies, database security and bugs that stop your app building or running. Built for apps made with Lovable, Bolt, Cursor, Replit and similar tools.

Connect GitHubHow it works

Already installed the App? GitHub signs you straight back in. First time here? We take you to the install step.

  • Cannot write to your repo
  • Code is never stored
  • No AI reads your code
your-org/your-appExample report

At riskA score, a breakdown by area and the findings that stand out, each with evidence.

Credentials or keys found in the codeHigh priority
Dependencies have known vulnerabilitiesHigh priority
Database tables without row-level securityMedium
+ more in the full reviewAsk us

Illustrative example, not a real result.

What it checks

Seven areas, each with its own rules and its own evidence. Every finding says where it was found and how sure we are.

  • Secrets and keys

    API keys, tokens, private keys and committed .env files. The value itself is never stored or shown.

  • Dependencies

    Exact locked versions checked against the open OSV vulnerability database, plus end-of-life runtimes.

  • Database security

    Supabase tables without row-level security, always-true policies and open Firebase rules, read from your repository.

  • Bugs and code that will not run

    Files that do not parse, imports that do not exist (including capitalisation that breaks only on Linux), merge conflicts, placeholder code.

  • Code patterns

    Injection, unsafe HTML, disabled TLS checks, open CORS and routes that change data with no visible auth check.

  • Project hygiene

    CI, tests, ignore rules, committed build folders and very large files.

  • Quality signals

    Swallowed errors, missing error pages, type escapes, debug leftovers and oversized files.

How it works

  1. Connect GitHub, read-only

    Install the Zovintra Code Review App on the repositories you choose. It can read file contents and nothing else.

  2. We read, never run

    Fixed rules scan the files as text. Nothing is installed, built or executed, and no AI reads your code.

  3. Get your score

    See an overall score, a breakdown by area and the findings that stand out, with the evidence for each.

The problems apps built with AI tools tend to hide

These tools ship fast, and they leave a trail. A first-pass review is the quickest way to see what yours left behind before a customer or an attacker does.

Run the free review
  • Database tables open to everyone
  • Keys that ship to the browser
  • Imports that fail only on Linux
  • Packages with known vulnerabilities
  • Code an AI tool left half finished
  • Addresses that only work on one laptop

How your code is protected

  • Read-only

    The App can read file contents and basic repository details. It cannot write, open pull requests or change settings.

  • One repository at a time

    Each review uses a token limited to the single repository you choose. It expires within an hour and is never stored.

  • We do not run your code

    Files are read as text. Nothing is installed, built or executed.

  • No AI reads your code

    Findings come from fixed rules and database lookups. The explanations are written in advance.

  • We keep findings, not code

    Reports hold the rule that matched, the file path and the line number. They are private, deleted after 30 days, and you can delete one any time.

  • You stay in control

    Remove the App on GitHub and every report for it is deleted automatically.

Questions

Is it really free?

Yes. You get your score, the breakdown by area and the top findings with their evidence. An engineer can go through the full list with you and verify the results.

Can it change my repository?

No. The App only has permission to read contents and metadata. It cannot push code, open pull requests or edit settings.

Do you keep my code?

No. We keep the rule that matched, the file path and the line number. The code itself is not stored, and reports are deleted after 30 days.

What happens after the review?

You have the report. If you want help, an engineer can verify the findings, remove false positives and talk through what matters for your project.

What will it miss?

Business logic, anything outside the repository and problems that only appear while the app runs. A static review is a first pass, not an audit.

This is an automated review based on the repository contents at one commit. It is not a security audit, penetration test or certification.