Safety scanner · free · no account
Check a repo before you run it.
Read in a sandbox, never executed, deleted once you have the report. It finds indicators of risky behavior; it cannot prove a repository is safe, and the report always says so.
example report[owner/repo] @ [commit]
review recommended3 indicators · 0 high risk
- Install-time execution1 indicator
- Remote code executionnone found
- Data collection1 indicator
- Credential accessnone found
- Obfuscationnone found
- Persistence and abusenone found
- Supply chain1 indicator
- Secretsnone found
| Severity | Behavior | Location | Confidence |
|---|---|---|---|
| medium | postinstall downloads and runs a scriptnpm lifecycle script pipes a fetched URL to a shell | package.json:14 | high |
| low | Undisclosed network call on startSends hostname and username; not mentioned in the README | src/telemetry.js:22 | medium |
| low | Unpinned remote scriptBuild fetches a script from a branch, not a commit | Makefile:8 | medium |
Secrets are reported by type and location, never shown.
Disposable and unprivileged
Each scan runs in its own container with no credentials, separate from the rest of urFluency.
Cloned defensively
Hooks, submodules, and LFS off; size, file-count, and time limits on.
Read, never run
Static analysis only. Install steps and scripts are inspected, not executed.
Nothing kept
The clone, the URL, and the report are deleted once delivered. Download it to keep it.
Verdicts
- no indicators foundNothing matched. Still review what you install.
- review recommendedBehavior worth reading before you run it.
- high-risk indicatorsPatterns common in malicious code. Do not run it unreviewed.