AI CODE SECURITY SCANNER FOR GITHUB

Find risky code before your users do.

Pallos reads your project and points out security mistakes in plain English. You see what is wrong, where it is, and what to do next.

Try the safe demo Scan a GitHub project

Read-only accessPlain-English resultsYou control every fix

pallos / scan-resultDEMO

Example result2 issues need your attention

Service key exposed to the browsersrc/lib/supabase-client.ts

Critical

Private action runs in a client componentcomponents/payment-settings.tsx

High

Why this matters

A private database key can bypass the rules your public app depends on.

TRY IT NOW

Test Pallos without connecting your project.

Use our safe demo or paste a public JSON API address. Pallos checks whether it works and shows the shape of the response.

Your data stays hidden. The result shows field names and types, never the returned values.

WHAT IT CHECKS

Six common mistakes, explained simply.

Pallos focuses on problems that can expose private data or give the wrong person too much access.

Exposed keys and tokens

Find private credentials that accidentally ended up in code a visitor can reach.

Overly open database access

Spot Supabase rules that may let the wrong person read or change data.

Weak admin protection

Check whether sensitive actions confirm the user has the right permission—not just that they signed in.

Private work running in public code

Flag server-only operations that were accidentally placed in browser code.

Risky code changes

Explain which recent changes deserve a closer look and why.

Fixes that still need proof

Rescan after a change so an issue is not marked fixed until the risky pattern is gone.

HOW IT WORKS

Connect. Understand. Fix.

You do not need to understand every line of code to make a safer decision.

Connect a project

Choose a GitHub repository or start with the safe demo. Pallos only reads the code you allow it to see.

Review the important risks

Pallos shows the affected file, what it found, and why it matters in plain language.

Fix and check again

Use the suggested next step, make the change yourself, then rescan to verify the issue is gone.

EXAMPLE REPORT

See exactly what a finding looks like.

Choose an example to see the problem, the affected file, and the suggested next step.

Open the full dashboard

Critical

Service key exposed to the browser

src/lib/supabase-client.ts

WHAT PALLOS SAW

A server-only credential appears inside code that can be delivered to the browser.

NEXT STEP

Move the key into server-only environment storage and verify database policies.

QUESTIONS

What to know before you connect a project.

What does the free API check do?

It checks whether one public JSON URL responds correctly and maps its structure without showing the returned values. The safe Pallos demo can be tested as many times as you want.

Does Pallos guarantee my app is secure?

No. Pallos checks a focused set of risks and shows exactly what it reviewed. It is a useful second pass, not a replacement for a full security program.

Do I need to be a security expert?

No. Pallos is written for founders, students, and developers who want clear explanations instead of a dense security report.

Will Pallos automatically change my app?

Not in V1. Pallos explains the issue and prepares a fix path, but you stay in control of every code change.

What stacks will be supported first?

The private beta is focused on JavaScript, TypeScript, Next.js, Supabase, and the common services used around them.

PRIVATE BETA

Help test Pallos.

Test Pallos on safe projects for about two months. We will contact you occasionally—not constantly—to ask what felt useful, confusing, inaccurate, or missing.

Run scans on public, staging, or disposable projects
Send short feedback when something is unclear
No payment or security expertise required

Create a tester account

Never submit production secrets or customer data.