secscan analyses files, repositories and websites for malware, leaked secrets, vulnerable dependencies and insecure code. Everything runs in isolated sandboxes; uploaded files are deleted right after the scan.
1. Choose what to scan
On the start page you find five tabs:
- File: drag files or an archive into the box. zip, tar, tar.gz/.tgz, tar.bz2, tar.xz, gz, bz2, xz, 7z and RAR archives are unpacked automatically; any other file is scanned as it is. If you select several files, your browser packs them into one archive before the upload.
- Repository: enter a public GitHub repository (
owner/repository), optionally with a branch, tag or commit. - URL: enter the address of a file. It is downloaded by a separate container that can only reach public internet addresses, never opened or executed.
- Website: enter a website address for a security scan with OWASP ZAP. See Scanning websites in this section.
- Search: find earlier scans by file name, MD5, SHA-256 or scan ID.
2. Watch the scan
A live view shows each stage: upload, verification, isolation, unpacking, inventory, the secscan heuristics, ClamAV, YARA and the verdict. You can leave the page; a running scan continues, and the Scans live counter in the header brings you back to it.
3. Read the report
Every scan ends with a verdict and a forensic report. The guide Understanding a report explains it in detail.
Good to know
- Uploads are resumable: if the connection drops, the upload continues where it stopped.
- Guest scans are limited to 3 per week and 10 MB, and show a summary only. A free account gives you 10 scans per week up to 100 MB with full reports.
- Do not upload personal data. You are responsible for the content you submit.