Free for open source
Free SAST for open-source projects
Assess your public repository's supported source code with Offensive360 SAST. Review security findings in your CI workflow, with SARIF output for code scanning. Free, renewable, no credit card.
How it works
Request a token
Submit your public repo URL below. We issue a free scan token, usually within one business day.
Add one CI step
Drop our GitHub Action or GitLab CI template into your pipeline with the token as a secret.
Review and remediate
Run scans in your pipeline and review file locations, technical evidence and remediation guidance where available.
GitHub Actions
- uses: offensive360/sast-scan-action@v1
with:
api-url: https://sast.offensive360.com
api-token: ${{ secrets.O360_API_TOKEN }}
upload-sarif: 'true'
fail-on: highFull docs: offensive360/sast-scan-action
GitLab CI
include:
- remote: 'https://raw.githubusercontent.com/offensive360/sast-scan-action/main/templates/gitlab-ci.yml'
# then set O360_API_URL + masked O360_API_TOKEN in CI/CD variables
Same engine, same findings — ExternalScanSourceType=GitLab under the hood.
Request your free token
For public repositories. We reply from [email protected] — usually within one business day.
The fine print (short version)
Source-code security scanning
Assess supported source languages with Offensive360 SAST. Rules, framework handling and finding evidence depend on the deployed version and configuration.
Public repos only
The token is for the public repository you register. Scanning private or commercial code on an OSS token gets it revoked.
30 days, renewable
Tokens expire after 30 days; renewals are a one-line email. This keeps abandoned tokens from floating around.
Your results stay yours
Findings go to your CI run and dashboard only. We never publish or share them.
Fair use
Scans run on the shared cloud instance. Very large repos may need to scan a subdirectory — or talk to us about options.
Frequently asked questions
What exactly is free for open-source projects?
Eligible public repositories receive free SAST scanning on our cloud instance. Use your scan token from CI or the API to assess supported source code. Language and framework coverage, data-flow evidence and available checks depend on the deployed version and configuration. Findings can include file locations, technical evidence and remediation guidance. No credit card is required; tokens are renewable.
Which projects are eligible?
Public repositories on GitHub, GitLab, Bitbucket, or Codeberg. Personal projects, community projects, and foundation-backed projects all qualify. Private repositories and commercial code need a commercial license — that is what funds the free program.
How do I get a token and how long does it last?
Submit the form with your repository URL. We issue a scan token bound to your project, typically within one business day. Tokens are valid for 30 days and renewed on request — just reply to the issuance email. Abuse (scanning private/commercial code with an OSS token) leads to revocation.
Do my scan results become public?
No. Findings are returned to your CI run (SARIF for the GitHub code scanning tab) and are visible only to you. We do not publish, share, or use your results for marketing. Responsible disclosure of what you find in your own project is entirely your call.
Is this SAST only, or DAST/MAST/SCA too?
The free open-source program covers SAST (static analysis of your source code). Dependency (SCA), DAST, mobile, and malware analysis are available in the commercial product — open-source maintainers who want those can contact us for discounted options.
Why is Offensive360 doing this?
Security tooling should not be a luxury for the projects everyone depends on. Free scanning for public repos hardens the open-source supply chain, and maintainers who like the engine tell their employers — that is the honest business motive. Both sides of that trade are good ones.
Commercial project? Book a demo or see pricing to discuss products, deployment and scanning scope.