Download
Free, MIT licensed, version 1.0.1
There is no paid tier, no seat count and no edition with the useful parts taken out. What is described on this site is what is in the repository.
Install it
One command on any machine with Docker.
curl -fsSL https://git.failoverlb.net/github-code-review/-/raw/master/get-gcr.sh | bashRead it first
The whole thing is one repository: a Python and FastAPI web application, a scanner written in bash that calls ten open source engines, and the documentation.
git clone https://git.failoverlb.net/github-code-review.gitWhat the license means here
MIT. Use it commercially, change it, ship it inside something else, keep your changes to yourself. There is no contributor agreement to sign and no clause that stops a competitor using it.
What it depends on
Ten open source engines do the reading: gitleaks, TruffleHog, semgrep, gosec, bandit, syft, grype, osv-scanner, trivy and zizmor. They are pinned to known versions in the image, which is why the install builds one rather than pulling a moving tag. Each keeps its own license and its own authors, and the report records the exact version of every engine that produced a finding.
What it sends anywhere
No telemetry, no analytics, no license check, no phone home of any kind. The only outbound traffic is to your own git hosts, to the public vulnerability databases, and to a credential's own issuer when live verification is switched on, which is one flag away from off. Nothing about your code leaves your network at any point.
Support
There is none to buy. Bugs and questions go to the repository. This is a tool somebody wrote because the commercial ones cost more than the problem was worth to their employer, and it is offered on exactly those terms.
Not sure it does what you need?
Forty capabilities scored against Snyk, GitHub Advanced Security, Semgrep, Checkmarx One and GitGuardian, with the rows that go against us left in.