How scanning works

secscan analyses what you submit (files or an archive such as zip, tar, 7z or RAR, a public GitHub repository, a file behind a link, or a website) and reports malware, leaked secrets, dangerous code patterns, known-vulnerable libraries and web security issues. Nothing you submit is ever executed.

Sandbox & isolation

• Every scan runs in a new container that has no network access, a read-only system, no Linux capabilities and runs as an unprivileged user; it is destroyed afterwards.
• Archives are unpacked with protection against zip bombs, path traversal and symbolic links; strict size, memory, process and time limits apply.
• Downloads (repositories, links) happen in a separate container that can only reach public internet addresses; internal networks are blocked twice, by the downloader and by the server firewall.
• Uploads are deleted right after the scan; reports are kept for 30 days and can be deleted at any time.

Detection engines

• ClamAV antivirus signatures, updated daily.
• YARA rules for web shells, crypto-miners and obfuscation (signature-base, php-malware-finder).
• secscan heuristics for injected JavaScript, card skimmers, hidden iframes, cloaking, PHP backdoors, DOM-based XSS, command injection, leaked API keys and passwords.
• OSV vulnerability database (npm, PyPI, Packagist, Go, crates.io), including known malicious packages, updated daily.