Every security scanner I've used has the same problem: the first run produces a wall of findings, half of them aren't real, and after a week nobody opens the report anymore. The scanner did its job. The humans gave up.
So I built OpenRouting. It runs proven open-source scanners on your repository, then has Claude, via Amazon Bedrock, review every finding before you see it: is this real or a likely false positive, how sure is it, what could go wrong, and what's the fix.
This post covers what it does today, what it deliberately doesn't do yet, and how the pricing works.
What a scan gives you
You sign in with Google or GitHub, connect a GitHub repository, and start a scan. Each finding in the dashboard comes with:
- A verdict: real issue or likely false positive, with a confidence score.
- A plain-English explanation of what could go wrong, written about your code, not a generic rule description.
- A suggested fix: the corrected lines, in your language and style.
- The reviewer that looked at it. Findings are routed to a specialist reviewer by category (SQL injection, SSRF, secrets, containers, CI/CD and more), so a JWT finding is judged with authentication knowledge, not generic advice.
Each issue is tracked once across every scan. Mark something false_positive, accepted_risk or fixed and it stays that way, with who changed it and why.
What it checks today
- Code flaws (SAST), hardcoded secrets and IaC/config, using Semgrep's rules on the files at the commit you scan: injection, XSS, unsafe deserialization, path traversal; cloud keys and tokens; Dockerfiles, docker-compose, Terraform, Kubernetes manifests and GitHub Actions.
- Pull requests: findings only in the files the PR changes, with one summary comment posted to GitHub when you click.
-
AI-agent setups: if your repo has
CLAUDE.md,AGENTS.md,.claude/agents, skills, hooks or MCP configs, they're reviewed for prompt-injection and tool-safety risks. - API collections: import a Postman, OpenAPI, Swagger, HAR, Insomnia or Bruno file and rules check for missing auth, secrets in URLs and over-shared responses. No traffic is ever sent to your API.
- Live websites, passively: an OWASP ZAP passive scan (headers, cookie flags, information leaks). No attack payloads.
- Reports: a downloadable Markdown or PDF security report you can hand to someone else.
- Your AI assistant: an MCP server lets Claude, ChatGPT or Claude Code search your findings and read the verdicts and fixes.
What it doesn't do (yet)
I'd rather you know this before signing up:
- No dependency/CVE scanning (SCA). It's planned, not shipped.
- No git-history secret scanning. Scans read the files at the commit you choose, not past commits.
- No active website scanning. Passive only.
- No CLI, CI action or auto-fix pull requests. It's a hosted dashboard plus GitHub.
- GitHub only for repositories today.
How your code is treated
The short version (a follow-up post covers the scanning sandbox in detail):
- Repositories are cloned, read and never executed: no installs, builds or scripts.
- Each scanner runs in a throwaway container with no network, a read-only copy of the repo, no root and no Linux capabilities.
- Only the minimal code around a finding is sent to the model, and known key and token formats are replaced with
[REDACTED]first. - The clone is deleted when the scan finishes. Only each finding's flagged lines are stored.
Pricing
No subscription. You pay with credits, per workspace:
| Action | Credits |
|---|---|
| Pull request review | 10 |
| Full repository scan | 20 |
| Agent-setup review add-on (only when a setup is found) | +10 |
| Security report (Markdown/PDF) | 10 |
| Passive website scan | 10 |
| API collection analysis | 20 |
| AI-agent setup pull request | 50 |
- 100 free credits when you sign up: enough for five full scans, or ten PR reviews.
- After that, $1 (or ₹85) buys 20 credits, in packs of 20.
- Credits are charged when a run starts and refunded automatically if it fails.
I picked credits over a monthly plan because small teams scan in bursts: before a launch, after a big merge, when a customer asks for a security review. Paying for what you run seemed fairer than a seat price.
Try it
- openrouting.si: sign in and scan a repo with the free credits.
- Pricing details
- No sign-up needed: the free Docker Compose explainer and Dockerfile explainer flag common misconfigurations in your browser.
I'd love feedback, especially on false positives it got wrong and checks you expected but didn't find. Comment here or reach me at hello@openrouting.si.
Top comments (0)