Scanner active
Each report is built per-repo — scan, patch, verify Most scans deliver in minutes; complex repos up to an hour Every finding includes file, line, evidence, and a repair step
● SYSTEM READY Now clear AI-built code before launch

Get the green light
before you launch.

AI builds it. Clira clears it. Paste a public GitHub repo. We scan, auto-fix what we can, verify the rest, and hand back a GO / HARDEN / STOP verdict you can show your users — each report built per-repo, most deliver in minutes, with no human in the loop.

⌘K to scan / to focus esc to cancel
clira  scan_
↵ run ⌘↵ copy cmd esc clear

Checking repository…

$149per launch · read-only clone · auto-fix · dated badge

// Sample report

A beautiful report. Not a PDF.

These three real findings came from a deliberately vulnerable repo — the same mistakes that hide in AI-built products every day. Every Clira report ranks the worst first, with the file, line, redacted evidence, plain impact, the fix, and the step to verify the fix.

  • Ranked by exploitability — critical first, not by category.
  • Redacted evidence — secrets stay masked, even in screenshots.
  • Plain-language impact — what a user or attacker could do.
  • Repair prompt — paste-ready instructions for your AI tool.
  • Verify step — a check to confirm the fix actually stuck.
clira.dev/reports/7a3f9c · github.com/yourname/your-app
DELIVERED
yourname/your-app · security report
3 findings · 58 patterns run · 8 languages scanned · each fix verified against your tests · ranked by exploitability
1
CRITICAL
1
HIGH
1
MEDIUM
CRITICAL CWE-798
A live Stripe key anyone can abuse
src/lib/checkout.ts:14
AUTO-FIX + VERIFIED
Evidence (redacted)
const stripe = new Stripe("sk_live_51M••••••••••••••••");
Impact in plain language

A live Stripe secret key is hardcoded in source. Anyone who finds this repo — including your AI tool's training data — can run charges against your account. The bill is yours.

Fix before launch
Move the key out of source. Read it from process.env.STRIPE_SECRET_KEY. Add .env to .gitignore. Rotate the exposed key in the Stripe dashboard right now.
Verify the fix
1 grep -r "sk_live_" src/ returns zero results. Reload the app. A test charge tagged clean succeeds. A test charge tagged missing-key fails.
Evidence (redacted)
export const config = { matcher: ["/((?!api|_next/static).*)"] };
Impact in plain language

The middleware matcher excludes every /api route from auth. Anyone hitting /api/admin/users lands in your dashboard unauthenticated. AI tools love writing this matcher — and it likes shipping.

Fix before launch
Reverse the matcher. Match on ['/admin/:path*', '/api/admin/:path*'] only. Add a server-side session check inside every protected route handler. Return 401 on missing or stale sessions.
Verify the fix
2 With a cleared cookie, curl /api/admin/users returns 401. With a forged cookie, still 401. With a real session, 200.
Evidence (redacted)
CORS(app, origins="*", supports_credentials=True)
Impact in plain language

A wildcard CORS origin with credentials enabled. That's the worst of both worlds: any domain can make a request and send the user's cookies. An attacker page in any browser becomes a one-click account takeover.

Fix before launch
Replace the wildcard with an allow-list. Read ALLOWED_ORIGINS from env. Return the request's Origin only when it matches. Never combine origins="*" with supports_credentials=True.
Verify the fix
3 curl -H "Origin: https://evil.example" -i returns no Access-Control-Allow-Origin. The same request to your domain returns your exact origin. Credentials never leave your domain.
clira-scan@1.0.0 · 2026-07-25 14:32:08 UTC 1 free rescan within 7 days
// What's covered

Six categories AI tools leave behind.

We stay in scope. Static repository analysis — not an exploit test, not a test of running infrastructure. We read the code, and we read only what you paste in. The same categories that broke the last ten AI-built launches are the ones we look for first.

Keys that can become instant bills

API keys, OAuth tokens, private keys, signing secrets, database URLs — anything that ought to live in an environment variable.

sk_live_*, AKIA*, ghp_*, etc.

Back doors into admin and user data

Missing session checks, trust-on-first-use, role checks that don't actually check, debug backdoors that shipped to production.

middleware-without-verify

Inputs attackers can turn into commands

SQL / NoSQL / template injection, shell injection, unsafe deserialization, raw string concatenation into risky APIs.

f-string-sql, eval, exec

Settings that fail dangerously in production

CORS wildcards, debug mode in release, permissive cookie flags, exposed admin panels, missing security headers.

cors-wildcard-credentials

Half-finished security logic

Rate-limits that don't rate-limit, captchas checked but never enforced, TODOs that survived to production, comments that lie.

dead-rate-limit, todo-security

Dependency & build failures

Pinned vulnerable versions, lockfiles that don't match, license-incompatible packages, supply-chain risk indicators.

outdated-cve, lockfile-drift
8 languages · deterministic pattern matching · 58 patterns
JavaScript TypeScript Python Go Ruby PHP Java Rust
// How it works

Six steps. One median.

Paste, pay, scan, auto-fix, verify, ship. The moat is the loop in the middle: we don't trust our own patches — every auto-fix is run against your tests before it ships, and only the patches that pass get delivered.

Step 01

Paste a repo URL

Public GitHub only. One URL, one command. Telemetry begins the moment you press return.

00:00Intake
Step 02

Eligibility check

We check access, language, and size before you pay. If we can't scan it, we tell you upfront — no charge.

00:08Gate
Step 03

Pay & clone

Stripe takes the payment. We clone a temporary, read-only copy into an isolated sandbox. Your repo is never modified.

00:34Sandbox
Step 04

Scan

58 patterns across 8 languages read the code. Findings are ranked by exploitability, not by category.

04:12Pattern run
Step 05

Auto-fix + verify

For findings we can fix, we generate a patch, apply it to the clone, run your tests, and only keep the fixes that pass. Fixes that fail your tests are discarded.

09:48Patch + verify
Step 06

Verdict + badge

Rated report, before/after diffs, and a dated Cleared by Clira badge you can show your users. Clone deleted within 60 seconds.

~1hTypical
clira — 80×24
# Step 1 — paste a repo $ clira scan --repo github.com/yourname/your-app → checking eligibility... → repo scannable · 58 patterns armed · 8 languages detected # Step 2 — pay & read-only clone $ clira pay --tier launch-clearance → cloning read-only into isolated sandbox → clone size: 1.4 MB · 142 files · 3.2k lines # Step 3 — scan $ clira scan --patterns=36 → 3 findings ranked by exploitability ● CRITICAL CWE-798 src/lib/checkout.ts:14 → auto-fix candidate ● HIGH CWE-306 src/middleware.ts:31 → auto-fix candidate ● MEDIUM CWE-942 server/app.py:22 → manual review # Step 4 — auto-fix then VERIFY (the moat) $ clira patch --apply=2 --verify=tests → patch 1: move sk_live_ to env → tests pass ✓ → patch 2: reverse matcher /api/admin → tests pass ✓ → 2 of 2 fixes verified · 0 regressions # Step 5 — verdict + badge $ clira report --open → verdict · HARDEN · 1 critical + 1 high fixed, 1 medium to review → badge generated · cleared by clira · 2026-07-25 → clone deleted in 60s · not retained by Clira
clira — patch verify loop
# Why "auto-fix + verify" is the moat → proposal: replace const Stripe("sk_live_...") with new Stripe(process.env.STRIPE_SECRET_KEY) → applying to clone at src/lib/checkout.ts:14 → running your test suite: npm test ✓ 142 pass · 0 fail · 0 skip → running secret-leak re-scan: clira scan --patterns=1 ✓ 0 finds · CWE-798 resolved → fix delivered. only the patches that pass get delivered. # A patch that failed verification (not shown to you) → proposal: rewrite auth middleware from scratch → applying to clone... → running your test suite: npm test ✗ 3 fail · auth.test.ts · session.test.ts → patch rejected · discarded — your tests are the authority # Three truths we hold → independence: the model that proposes a fix is never the one that grades it → verification: tests pass or the fix doesn't ship → honesty: if we can't fix it, we say so and tell you why
// Pricing

Clear for this launch.
Stay clear as threats evolve.

One-time clearance. Pay once for the full scan, the auto-fixes, the verify loop, and a GO / HARDEN / STOP verdict you can show your users. No subscription, no lock-in. If we can't deliver, full refund or free rerun — your call.

// One-time clearance Get clear before you launch — pay once for the full audit.
Free
Lead magnet
3 real findings from an actual scan. Email-gated, rate-limited. No fixes — just the anxiety that drives the paid cure.
$0 per repo
Run free self-check
Launch Clearance
Most popular
The hero. Full scan, auto-fixes that pass verification, GO / HARDEN / STOP verdict, dated badge, 1 free rescan within 7 days.
  • 58 patterns across 8 languages
  • Auto-fix + verify loop (the moat)
  • Ranked report with file, line, fix, and verify
  • Shareable dated clearance badge
  • One free rescan within 7 days
  • Refund or rerun if we can't deliver
Launch special · $50 off
$149 $99
per launch · list $149 First 100 scans · ends soon
Get launch clearance →
Verified Clearance
For paying customers
Independent AI-model consensus. Multiple frontier models cross-verify every finding, killing false positives. Adds automated compliance readiness (SOC 2 / ISO 27001 / GDPR).
  • Everything in Launch Clearance
  • Independent cross-verification on every finding
  • Automated compliance readiness (vciso-rubrics)
  • Verified "Cleared by Clira" badge
$349 per launch
Coming soon

Every tier includes refund or free rerun if we can't deliver a report.

// Trust

The questions you'd ask before you paste a URL.

We'd rather you ask before you pay than after. The answers are short, the answers are honest, and the answers are the same ones we'd give a paying customer.

✓
Read-only by design

We don't push, don't open issues, don't have keys.

✓
Deleted in 60 seconds

Your report is the only thing that survives. The clone is gone.

✓
Clira never trains on your code

Clira does not use your code to train any model. Code is processed by third-party AI providers for inference under their own data policies.

✓
Eligibility first

We check the repo is scannable before you pay. No wasted charges.

✓
Refund or rerun

If we can't deliver, you don't pay. Or we run it again, your choice.

✓
Dated badge

"Cleared by Clira · [date]" — honest, ages visibly, motivates re-scan.

C
Cleared by Clira github.com/yourname/your-app Scan completed 2026-07-25 · report delivered via secure link
The honest limit Clira is AI-powered static repository analysis — not an exploit test, not a guarantee, and not a substitute for ongoing security practice. We find and fix what our models can detect, as of the scan date. Results are "as is" and "as at" the time of scan; no warranty that a future model or technique won't find more. Security evolves — stay cleared by re-scanning.

We clone a temporary, read-only copy into an isolated sandbox. Within 60 seconds of delivering your report, the clone is destroyed. We retain only report metadata — a SHA-256 of the repo, the findings count, and the report ID — for the sole purpose of dispute resolution. Clira does not train on your code. Code is processed by third-party AI providers for inference under their own data policies.

No static analyzer catches everything. We say that clearly. Specifically: we don't run your app, we don't fuzz a live server, we don't test auth against a real deployment. We read code, and we read only what you paste in. If a finding exists in your repo and we don't surface it, the rescan within 7 days is free.

Yes. If we can't deliver a report — wrong language, build failure, eligibility failure — we refund or rerun, your choice. If we deliver and you disagree with the findings, you don't get a refund, but every purchase includes one free rerun within 7 days.

No. An exploit test is a human attacker, on a running system, attempting to break in. Clira is a static analyzer that reads your repository and tells you what the code says about itself. Use us for what we are; hire a real firm for what a real firm does.

For every finding we think we can fix, we (1) propose a patch, (2) apply it to the read-only clone, (3) run your test suite, (4) run a re-scan for the same finding. A fix is only delivered if your tests pass and the re-scan is clean. The model that proposes a fix is never the one that grades it. If a patch fails, it is discarded — you never see a broken fix attributed to us.

JavaScript, TypeScript, Python, Go, Ruby, PHP, Java, and Rust. If your repo is primarily in another language, we tell you at the eligibility check and don't charge you. The scan uses deterministic pattern matching across 58 patterns — the same patterns run every time, so results are reproducible. This is static analysis, not dynamic testing or an exploit proof.

The badge says "Cleared by Clira · 2026-07-25" and links to a verification page. It's a public trust signal you can display — a dated, auditable snapshot, not a perpetual "secure" claim. The date ages visibly on purpose. That motivates re-scanning as the landscape evolves.

Because we sell clearance, not a subscription. "Per launch" is honest: each Launch Clearance is a one-time scan tied to a specific version of your code. If you ship v2 next month, that's a new launch — and we want you to re-scan, because threats evolve. The subscription tier is called Watchtower for the same reason: it's ongoing protection, not "unlimited scans."

The checklist is the findings list — you act on it yourself. The clearance scan adds the auto-fix + verify-against-your-tests loop and a dated GO / HARDEN / STOP verdict. One is information, the other is clearance. If you want a badge to put on a launch page, the clearance is the only one that earns it.

No. Public GitHub only, right now. We check the repo is public and eligible before you pay — if it isn't, you don't get charged. Private repo support is on the roadmap, but we won't promise a date we haven't earned yet.

GO means the scan is clean enough that we'd ship it. HARDEN means there are real findings — you get fix patches and a list of what we couldn't auto-fix. STOP means we found something a launch shouldn't ship with, and we tell you exactly what. No spinning, no metric theater — the verdict is the verdict on the date.

No. Paste a URL, we clone read-only into an isolated sandbox, nothing touches your machine or your repo. No CLI, no GitHub App, no browser extension. The verification badge is a public URL — that's the only thing that lives after the scan.

No. It's a dated snapshot — the badge literally says "as of 2026-07-25." Tomorrow's CVE, today's undiscovered model finding, next month's supply-chain attack: none of those are in the scan. The honest reading is "Cleared by Clira on this date, with these models, by these humans." Re-scan to stay cleared.

No. We clone a temporary, read-only copy into an isolated sandbox, run the scan, and destroy the clone within 60 seconds of delivering your report. What we keep: a SHA-256 fingerprint of the repo, the finding count, and the report ID — enough to verify a badge, not enough to reverse your code. Your source never lands on our storage.

There will be some. Every static analyzer flags things that aren't real bugs in your context — a test fixture that looks like a credential, a TODO that looks like a real identifier. We tune to keep the rate low, but never zero. Flag any finding you think is wrong inside the report — it goes to a human reviewer, and if we agree, we fix the model's miss and you keep the clearance.

// Final clearance

Scan before launch.
Don't be the next headline.

Every day unfixed is another day exposed. The $20 fix is cheaper than the $20,000 breach. Find the flaw before a user, attacker, or surprise bill does.

Checking repository…

Not launching yet? Run the free 2-minute self-check →