Free for open source
Free SAST for open-source projects
Public repository on GitHub or GitLab? Scan it with the full Offensive360 SAST engine — 60+ languages, real taint analysis, findings straight into your code scanning tab. Free, renewable, no credit card.
How it works
Request a token
Submit your public repo URL below. We issue a free scan token, usually within one business day.
Add one CI step
Drop our GitHub Action or GitLab CI template into your pipeline with the token as a secret.
Fix real findings
Every push gets scanned. Findings land in your code scanning tab with file/line, impact, and how to fix.
GitHub Actions
- uses: offensive360/sast-scan-action@v1
with:
api-url: https://sast.offensive360.com
api-token: ${{ secrets.O360_API_TOKEN }}
upload-sarif: 'true'
fail-on: highFull docs: offensive360/sast-scan-action
GitLab CI
include:
- remote: 'https://raw.githubusercontent.com/offensive360/sast-scan-action/main/templates/gitlab-ci.yml'
# then set O360_API_URL + masked O360_API_TOKEN in CI/CD variables
Same engine, same findings — ExternalScanSourceType=GitLab under the hood.
Request your free token
For public repositories. We reply from [email protected] — usually within one business day.
The fine print (short version)
Real engine, not a teaser
Same SAST engine and rules as the commercial product — 60+ languages, interprocedural taint analysis, remediation guidance per finding.
Public repos only
The token is for the public repository you register. Scanning private or commercial code on an OSS token gets it revoked.
30 days, renewable
Tokens expire after 30 days; renewals are a one-line email. This keeps abandoned tokens from floating around.
Your results stay yours
Findings go to your CI run and dashboard only. We never publish or share them.
Fair use
Scans run on the shared cloud instance. Very large repos may need to scan a subdirectory — or talk to us about options.
Frequently asked questions
What exactly is free for open-source projects?
Full SAST scanning on our cloud instance — the same engine commercial customers use, covering 60+ languages with taint and data-flow analysis. You get a scan token for your public repository, run it from GitHub Actions, GitLab CI, or the API, and findings include file/line locations, impact, and remediation guidance. No credit card, no trial clock.
Which projects are eligible?
Public repositories on GitHub, GitLab, Bitbucket, or Codeberg. Personal projects, community projects, and foundation-backed projects all qualify. Private repositories and commercial code need a commercial license — that is what funds the free program.
How do I get a token and how long does it last?
Submit the form with your repository URL. We issue a scan token bound to your project, typically within one business day. Tokens are valid for 30 days and renewed on request — just reply to the issuance email. Abuse (scanning private/commercial code with an OSS token) leads to revocation.
Do my scan results become public?
No. Findings are returned to your CI run (SARIF for the GitHub code scanning tab) and are visible only to you. We do not publish, share, or use your results for marketing. Responsible disclosure of what you find in your own project is entirely your call.
Is this SAST only, or DAST/MAST/SCA too?
The free open-source program covers SAST (static analysis of your source code). Dependency (SCA), DAST, mobile, and malware analysis are available in the commercial product — open-source maintainers who want those can contact us for discounted options.
Why is Offensive360 doing this?
Security tooling should not be a luxury for the projects everyone depends on. Free scanning for public repos hardens the open-source supply chain, and maintainers who like the engine tell their employers — that is the honest business motive. Both sides of that trade are good ones.
Commercial project? Book a demo or see pricing — flat, per-project, unlimited users and scans.