AI-assisted security review of your codebase.
Repolit reviews your code for security weaknesses, exposed secrets, and known-vulnerable dependencies, then explains each finding in plain language so you can act on it. It is one of the seven dimensions behind your codebase health score.
WHAT THE REVIEW COVERS
Vulnerability review
AI review of the code for common weakness patterns.
Secrets detection
Flags credentials and keys committed into the source.
Dependency CVE mapping
Matches dependencies against a curated vulnerability list.
What this is not: This is an AI-assisted review, not a certified SAST scanner or a compliance audit. Dependency checks use a curated list, not an exhaustive advisory database.
Security, honestly
- Does Repolit replace a SAST scanner?
- No. Repolit's security review is AI-assisted — it reads your code for common weakness patterns and explains them in plain language. It is not a certified SAST scanner or a compliance audit, and it does not replace one.
- What does the security review actually check?
- Three things: common code weakness patterns, credentials and keys committed into the source, and dependencies that match a curated list of known-vulnerable versions. Each finding is explained so you can judge and act on it.
- How complete is the dependency vulnerability check?
- It matches your dependencies against a curated vulnerability list, not an exhaustive advisory database. Treat it as a fast first pass that surfaces well-known issues, not as a guarantee that every advisory has been considered.
- Where does my code go during a security review?
- You can run the review from the web app or the CLI. For sensitive code, the local studio analyzes code on your own machine; AI features still call the configured model provider. Repository connections support GitHub, plus folder or ZIP uploads.