Frequently asked questions

Not in any lasting way. When you submit a repo, we clone it into an isolated, ephemeral sandbox, run the scan, and delete the clone immediately when it's done. The only things we keep are the findings — the specific lines and snippets that triggered a rule — stored encrypted in your account.

We don't keep a copy of your full codebase. Read the full details in our Privacy Policy →

Our rules are tuned for the languages that AI code generators most commonly produce: JavaScript, TypeScript, Python, and common web-stack patterns (Express, FastAPI, Flask, Next.js, etc.). Dependency audits work for any project with a package.json or requirements.txt.

Some rules apply across languages (hardcoded secrets, insecure patterns); others are language-specific. Every scan report tells you exactly which files were checked and which rules ran.

Honestly: it's a first-pass scanner, not a comprehensive security audit.

We're tuned for patterns that AI code generators reliably produce — hardcoded secrets, raw SQL queries, wildcard CORS, weak JWT config, and so on. We catch those well. We're less thorough on business-logic flaws, runtime behaviour, and infrastructure configuration.

This is why every scan report includes a coverage note— a plain list of what we checked and what we didn't. “No findings” doesn't mean “no vulnerabilities.” It means we didn't find anything in the areas we specifically looked for. See full coverage →

No. ShadowOps is a web tool. Paste a URL, connect a repo via OAuth, or upload files — the scan runs in our infrastructure. No CLI required, no IDE plugin required.

Yes. Connect your GitHub, GitLab, or Bitbucket account via OAuth. We request only the minimum permissions needed to clone the repos you select. Your OAuth token is stored encrypted and used only for that purpose.

Those are excellent tools built for security teams. They output CVE IDs, CVSS scores, and CWE references — the right language for an engineer who lives in security tooling.

ShadowOps is built for a different situation: you used Cursor, Lovable, v0, or Bolt to build something, it works, and now you want to know if it's safe to ship — without having to learn what a CWE code means.

Every finding is explained in plain English: what it is, why it matters, and what to do about it. We're also honest about what we didn't check, which most tools aren't.

When you view a finding, you can mark it “Real issue” or “Not a problem.” This helps us distinguish real vulnerabilities from false positives.

When you label a finding, we store a short encrypted code snippet (max 500 chars), the file extension, rule ID, category, severity, and your label. Nothing that identifies you or your repo.

To opt out: go to Settings → Privacy → Finding Labels and disable the toggle, or email hello@shadowops.in.

Yes. Email hello@shadowops.in with your account email and we'll delete your account and all associated data within 30 days.