Does SafeWeave store my code?
No. Scans from your editor or terminal run on your own computer and send only severity counts. Cloud scans clone your repository, scan it and delete the copy. SafeWeave keeps the findings and a short excerpt of code around each one so you can fix it in context, and never keeps an excerpt for a secrets finding. See Your data and privacy.
Do I need an account?
You can try a few scans in your editor or terminal without one. A free account gives you every free scanner with no limit on scans, one connected repository and the dashboard.
What's the difference between Free and Cloud?
Free shows your grade and finding counts, and runs scanners on your computer. Cloud scans every connected repository on each push and pull request, shows every finding with its fix, adds AI fixes, GitHub checks with full details, vibe-coded app checks, live app checks and monitoring. See Choosing a plan.
How is my score calculated?
It starts at 100 and drops 25 for each critical, 15 for each high and 5 for each medium finding. See Reading your results.
Is the Cloud trial free?
Yes, for 14 days. Checkout asks for a card; you're charged only if you don't cancel before the trial ends. Cloud Plus has no trial; it has a 14-day money-back guarantee instead.
How do I cancel?
Settings → Plan & billing → Cancel subscription → Confirm Cancellation. Your plan stays active until the end of the period you've paid for, then your account goes back to Free with the same license key.
What if I lose my license key?
Go to Settings and click Regenerate license key, then Regenerate Key. Your old key stops working straight away. See Your account.
Can I use SafeWeave in CI?
Yes. Use the GitHub Action, or run npx -y safeweave-mcp scan . --format sarif --fail-on high in any CI. See Scan from the terminal.
Is scanning my live app safe?
Yes. App URL scans send ordinary requests and a rate-limited, non-destructive probe. Live checks only read, they never change anything. Only scan apps you own or have permission to test.
Which AI does "Explain & fix with AI" use?
Anthropic's Claude. Only the finding and its code excerpt are sent, and Anthropic doesn't train on this data.
What can SafeWeave see in my Supabase account?
Only the list of projects in the organisation you approve and Supabase's security checks for the projects you choose to monitor. SafeWeave never reads the data in your tables and never changes your projects. Disconnect any time on Integrations. See Supabase.
Can my team use one account?
On Cloud Plus, each teammate gets their own access and license key. See Working as a team.