Prioritized finding
Normalized severity, stable rule identifier, confidence, and CWE context where available.
Public Code Zone · No account required
Find security issues in a code sample before you create an account.
Run bounded static analysis and inspect normalized severity, rule identifiers, source-to-sink context, and remediation guidance. No source execution. No enterprise claims.
- 10 evaluation reviews
- Up to 50 KB and 2,000 lines
- Validation errors do not use an allowance
Public-trial safety: use a non-sensitive sample. Do not submit secrets, personal data, proprietary source, credentials, or private model weights.
10guest reviews
50 KBmaximum sample
2,000maximum lines
0source execution
What one review gives you
A finding you can inspect—not a mystery score.
Public results are intentionally redacted, but they preserve the technical context needed to judge whether the review is useful.
Traceable path
Source, propagation, and sink line references when the analyzer identifies a data flow.
Actionable remediation
Specific defensive guidance without reproducing the submitted code in the public response.
Want to evaluate the actual output?
Run a Public ReviewFour-step evaluation
Paste. Review. Decide whether to continue.
- 01
Choose a safe sample
Use non-sensitive code up to 50 KB or 2,000 lines.
- 02
Run static analysis
The public web process does not execute submitted source.
- 03
Inspect the result
Review redacted findings, trace context, and remediation.
- 04
Continue if useful
Create a verified account only when governed access is needed.
Transparent boundaries
Public evaluation versus verified Code Zone access.
The guest experience demonstrates finding quality. Authenticated capabilities remain tenant-scoped and plan-dependent.
Swipe horizontally to compare verified access.
| Capability | Public evaluation | Verified access |
|---|---|---|
| Account | Not required | Verified account and workspace |
| Allowance | 10 completed reviews | Plan-based usage |
| Analysis | Non-executing static analysis | Governed controls by workflow |
| Evidence | Digest and public-safe summary | Tenant-scoped records and retention |
| Release or certification | Not provided | Still subject to policy, reviewer, plan, and tested scope |
| API and CI/CD | Not included | Plan-dependent integration |
Safe evaluation scope
Use representative code, not production secrets.
- Minimal reproductions of a security pattern
- Open-source or intentionally shareable samples
- Sanitized framework and language examples
- Code written specifically for evaluation
- Credentials, tokens, secrets, or private keys
- Personal, financial, health, or customer data
- Proprietary repositories or private model weights
- Production configuration and internal endpoints
PythonJavaScriptTypeScriptJavaGoRustText
Public evaluation FAQ
Know the boundary before you submit.
Does Code Zone execute my source?
No. The anonymous evaluation uses static analysis only and does not execute the submitted source in the web process.
What is retained for a guest review?
The guest service retains a source digest and public-safe result metadata. Submitted code is not reproduced in the public finding response.
Does a result certify or approve my code?
No. A public result is an evaluation finding, not certification, legal-compliance approval, or production-release approval.
What happens after ten reviews?
Create and verify an account to continue through plan-based, tenant-scoped Code Zone access.
Review a safe code sample now.
No account is required for the public evaluation. Use non-sensitive code and inspect the result before deciding whether to register.