Secrets
Keys, passwords and tokens across the whole Git history, not only in the current state.
Security review for GitHub organisations
Security and architecture review for your GitHub organisation, with ready-to-run fix commands.
A scan for secrets, dependencies and hygiene on every working day, an architecture review every month. For software companies and agencies without their own security team, and for internal IT that builds its own software.
- Read-only access, only to the repositories you choose
- Source code is not stored
- First report on the next working day
CriticalSecret in the history
contoso/shop-api · config/settings.py · commit 4f2a91c
An API key has been in the repository since the first commit. It is deleted in the current state but still readable in the history.
Fix command for Claude Code
claude "Rotate the key in config/settings.py, read it from the vault from now on and remove it from the history."- findings
- 23
- repositories
- 12
- coverage
- 97 %
How it works
Four steps from access to a ready fix.
- 01
Install
The GitHub App only reads, and only the repositories you choose.
- 02
First report
On the next working day: secrets across the whole history, vulnerable dependencies, repository hygiene and an AI review of changes.
- 03
Monthly review
An architecture review with measured coverage and a PDF report for management.
- 04
Fix
A ready-to-run Claude Code command for every finding, as a GitHub issue if you like.
Checks
What Code Guard checks in your repositories.
The basics on every working day, the architecture every month. Every finding names place, rule, description and recommendation.
Dependencies
Packages with known vulnerabilities, per repository and version.
Repository hygiene
Missing branch protection, public repositories, failing pipelines, stale pull requests.
AI review of changes
New commits are read for security and quality defects. Secrets are redacted first.
Architecture review
Once a month, with measured coverage in the report instead of an estimate.
Report and issues
A PDF for management, findings as GitHub issues in the affected repository if you like.
14 days free
The trial is not a teaser. It is the full report.
Many tools show a slice for free. During the 14 trial days Code Guard delivers everything your plan includes, the architecture review too, which the usual tools do not offer at all.
Every repository of your plan
No single sample repository: we check what you choose, up to the limit of the plan.
The whole Git history
Secrets in old commits as well, even when they are long gone from the current state.
A complete architecture review
The monthly review already runs in the trial, with measured coverage instead of an estimate.
A PDF for management
The monthly report to pass on, readable without technical background.
A fix command for every finding
Ready-to-run commands for Claude Code that your team can use straight away.
No risk
Cancel before day 15 and you pay nothing. After that, cancel monthly.
For the trial you add a payment method at checkout; nothing is charged before day 15. One trial per organisation.
Privacy
Your code stays your code.
Read-only
The app only reads. It cannot change, create or delete anything.
No copy of the code
Source code is not stored. Findings are: place, rule, description, recommendation.
Redacted before the AI review
For the AI review, code is sent to Anthropic, only through an access without data retention; secrets are redacted first.
Plans
A plan for every size of organisation.
Starter
€49 per month
- up to 3 repositories
- scan on every working day
- monthly architecture review
Team
€19 per repository and month
- from 5 repositories, from €95 a month
- scan on every working day
- monthly architecture review
Business
€390 per month
- up to 25 repositories
- scan on every working day
- monthly architecture review
- PDF for management
- findings as GitHub issues
Enterprise
On request
- more than 25 repositories
- scan on every working day
- monthly architecture review
- PDF for management
- findings as GitHub issues
- budgets and contract to your needs
FAQ
What customers ask before the trial.
Which permissions does the GitHub App get?
Read-only ones: contents, metadata, checks and Dependabot alerts of the repositories you select at installation. The app cannot write. Issues are only created by the separate app "NEXT Code Guard Issues", and only if you install it on purpose.
Is our code stored?
No. For a run the repository is cloned into a folder of its own that only the service account can read, and deleted when the run ends. What is stored are findings without code: place, rule, description and recommendation.
Where does our code go?
The runs take place on servers of TOMORIS GmbH in Austria. For the AI review, redacted excerpts go to Claude by Anthropic in the USA, only through an access with zero data retention. Without that access there is no AI review, and the report says so.
How is this different from GitHub Advanced Security?
GitHub Advanced Security is licensed per active committer and reports findings in each repository. Code Guard is priced per plan or repository, brings the whole organisation into one dashboard, adds a monthly architecture review with measured coverage and gives a ready-to-run Claude Code command for every finding. They do not exclude each other: Code Guard reads GitHub's Dependabot alerts as well.
Which programming languages does Code Guard support?
The secret search works for any language. The dependency check covers the common package formats, such as npm, NuGet, PyPI, Maven, Go, Cargo, Composer and RubyGems. The AI review and the architecture review read every common language, such as C#, TypeScript, JavaScript, Python, Java, Go, PHP and PowerShell. The portal is in German.
How do I cancel?
Any time to the end of the current month, without giving a reason, by e-mail to [email protected]. Cancel within the 14 trial days and you pay nothing. What is paid for stays usable until the end of the month.
Do we get an invoice?
Yes, every month an invoice from TOMORIS GmbH by e-mail, net plus 20 % Austrian VAT. Payment happens at checkout. Self-service purchase is open to companies based in Austria today; from other countries, write to us.
Does Code Guard help with NIS2?
NIS2 requires security in the development and maintenance of systems, vulnerability handling and supply chain security (Article 21(2)(d) and (e) of the directive). Code Guard provides ongoing evidence for this: weekday scans, the monthly review and the PDF report. Code Guard alone does not make a company NIS2 compliant.
Ready for your first report?
The app installs in a few minutes. The first report follows on the next working day.