Committed secrets
API keys, tokens and connection strings found on default branches, shown masked.
Continuous security posture for agencies
Is every client secure yet?
SecureYet watches every repository you are responsible for - committed secrets, vulnerable packages, end-of-life runtimes - and answers one question for each client: yes, or not yet, and what to fix first.
Free for up to 5 repositories. Read-only GitHub access.
secureyet.app/app
Posture summaryAct now32 repositories across 7 clients · refreshed 2h ago
Secure yet?
Not yet.
3 of 32 repositories need action now, and 5 more need a look.
Most urgent: 2 committed secrets, all in Northwind.
Open work
83of 100
3 act now5 watch24 clear
How it works
From GitHub to an answer in minutes
- 1
Connect GitHub
Install the read-only GitHub App on your organisation. Private repositories included.
- 2
Group by client
File each repository under the client it belongs to - an API behind several sites counts for each of them.
- 3
Get the answer
Every client gets a verdict and a score, refreshed on a schedule, with a weekly digest by email and a mail on the days something new is found.
What it watches
Six checks, one verdict per client
Everything a client would ask about their code's security, read from the repositories themselves and ranked by what cannot wait.
Vulnerable packages
Every lockfile read and checked against OSV.dev, on GitHub, GitLab and Azure DevOps alike, by severity - with the fixed version when there is one.
End-of-life runtimes
.NET, Node.js, PHP, frameworks and containers past support - or about to be - from endoflife.date.
Blind spots
Repositories whose dependencies cannot be read, and projects without a lockfile. Nothing found is not the same as safe.
Bill of materials
Every package every client runs, searchable across the estate, exportable as CycloneDX.
Licence compliance
Copyleft and unknown licences flagged, per package and per client.
Hand every client an audit pack
Repositories, runtimes, vulnerabilities, credentials and licences for one client, as a printable report or Markdown - and their bill of materials as CycloneDX.
Audit packSBOM
Pricing
Start free, grow with your estate
Every plan answers the same question. Bigger plans bring more people and more repositories, checked more often and more deeply. Clients are unlimited on every plan.
Free
For trying SecureYet on a few repositories.
- 2 users
- 5 repositories
- Unlimited clients
- Refreshed weekly
- Refreshed on every push
- 3 manual refreshes a day
- Vulnerable packages
- Bill of materials
- Licence compliance
- Secret scanning
- Retiring AI models
- Weekly digest and daily mail
- Jira integration
- Single sign-on (SAML, Entra ID)
Team
For an agency watching its clients’ estates.
- 10 users
- 150 repositories
- Unlimited clients
- Refreshed daily
- Refreshed on every push
- 25 manual refreshes a day
- Vulnerable packages
- Bill of materials
- Licence compliance
- Secret scanning
- Retiring AI models
- Weekly digest and daily mail
- Jira integration
- Single sign-on (SAML, Entra ID)
Business
For companies that need every check, every user and single sign-on.
- Unlimited users
- Unlimited repositories
- Unlimited clients
- Refreshed every 6 hours
- Refreshed on every push
- Refresh on demand, any time
- Vulnerable packages
- Bill of materials
- Licence compliance
- Secret scanning
- Retiring AI models
- Weekly digest and daily mail
- Jira integration
- Single sign-on (SAML, Entra ID)
About
Built for the people who answer for other people's code
An agency that builds and runs sites for its clients ends up holding dozens of repositories it is quietly responsible for. Most are finished, some are shared between clients, and nobody looks at them until something goes wrong.
SecureYet exists to make that responsibility visible: one place that reads every repository, knows which client each belongs to, and answers the question a client will eventually ask - is our code secure yet?
Read-only by design
The GitHub App reads. It never writes to a repository, opens a pull request or changes a setting.
Secrets stay secret
A committed credential is only ever shown masked - enough to find and rotate it, never enough to use it.
Honest answers
A repository nobody can scan is never counted as secure. "Yes" means every check ran and came back clean.
Your data, yours
Export everything as one file whenever you like, and delete the organisation when you are done.
Find out where every client stands.
Connect GitHub, file a few repositories, and get your first answer today.