From repository URL to merged fix.
Four steps, most of which happen while you get a coffee.
01
Connect
Sign in with GitHub. We ask for your public profile and email only. Paste the URL of a public repository, or paste a snippet.
02
Fetch
We read source files from the default branch, skipping dependencies, build output, lockfiles, minified files and anything over 60 KB, up to your plan's file budget.
03
Audit
Claude Fable 5.1 reviews the code with a senior-auditor brief. It must answer through a strict schema, so every report has the same shape and every finding carries evidence.
04
Fix
Read the findings in severity order, copy the suggested patch, and re-audit to confirm the risk score went down.
Anatomy of a finding
Every finding in every report has the same fields, so you can scan fifty of them without re-learning the layout.
- Severity and confidence
- Critical to info, rated by real exploitability, with high, medium or low confidence.
- CWE and location
- A CWE identifier and the file and line range the finding is about.
- Evidence
- The exact code excerpt, quoted from your repository, that demonstrates the issue.
- Exploit scenario
- How an attacker would realistically abuse it, in two or three sentences.
- Remediation
- A concrete fix, usually a corrected snippet written in the style of the surrounding code.
SQL injection in user search
req.query.name is concatenated into the query, so any visitor can read or drop the users table.
41 export async function search(req) {- 42 const q = `SELECT * FROM users WHERE name = '${req.query.name}'`;+ 42 const q = 'SELECT * FROM users WHERE name = $1';+ 43 return db.query(q, [req.query.name]);Why the reports are trustworthy
Evidence or silence
The auditor is instructed not to raise findings it cannot quote. Vague best-practice advice is kept out of the findings list.
Your code is untrusted input
The system prompt treats your source strictly as data to audit and is hardened against instructions hidden in comments.
Structured by construction
The model answers through a forced tool call with a JSON schema, so a report can never be half-formatted prose.
Find the bug before an attacker does.
Sign in with GitHub and run your first audit in under a minute. The free plan needs no credit card.