Scope & limitations
The focused scan checks current application and configuration files across folders. Dependencies, caches, common media/binary/archive formats and Git history are excluded and listed in coverage. Select Extended scan to include them, other branches/tags, commit messages, readable binary strings and supported archive contents. Accessible LFS objects and public GitHub submodules are attempted. No project code is executed. Binary scanning is not OCR or decompilation. Authentication failures, unsupported formats and limits are listed individually. Values in test, fixture, mock, sample and example folders or test-named files, and values marked as test or placeholder data, are counted but not listed. A value in a test file that looks like a real key is still listed, marked as found in a test file. This separation relies on file paths and value patterns, so it can miss sensitive information or hide a real value that looks like test data.
Budget: 10 minutes, 2 GiB inspected content, 64 MiB per decoded archive/LFS object, 4 nesting levels and 20 submodule snapshots. Unreachable Git objects cannot be inspected. No key is tested against its provider. This is an exposure review, not a complete code vulnerability audit.
What the free web check reads, its limits and FAQ
Full repository scans run locally in Redaxa for Windows. Included with Pro and Business.