Every file, every past version, every branch and pull request of a repository — read inside a sealed sandbox. Nothing from the project ever runs on your Mac, and a plain-language verdict tells you what to do next.
Recent attacks on real projects hid loaders after hundreds of blank spaces in config files, inside "fonts" that a VS Code task runs when the folder opens, and in pull requests that were never merged. Removing them from the latest files is not enough: the history still carries them, one command away. SecureCode Auditor was built while cleaning those incidents up — and now does it for you.
The result leads with one sentence and a colour you can't misread, then what to do — stop installing it, rotate credentials — and where each problem lives: in the current code, or only in history.
Audits run on every core the sandbox is given, with a real percentage, the step it's on and the time left. A repository with 27,000 commits and 7,000 pull requests takes about six minutes.
Check who can push and who really pushed, rebuild the branch as one clean commit, approve the exact commit before it's pushed, verify it from a fresh copy, and send GitHub the message that purges the old history.
The app checks for a container app, sets up the sealed scanner from the copy it ships with — no download — and fetches the latest fingerprints. Five short steps, once.
A folder on your Mac, a ZIP someone sent you, or a repository's address. For private repositories, a read-only token used for that audit only.
Your Mac only moves the bytes. The code is opened in a container with no network, a read-only file system and no permissions — and nothing is checked out, installed, built or run.
Known malware is confirmed by exact fingerprints; everything else is "needs review" with the evidence shown. Clean, well-known projects are used to keep false alarms rare.
Remove leftovers from a copy or rebuild the history, and re-audit to confirm nothing is left.
There are no accounts, no analytics and no telemetry. Audits live in memory and are gone when you quit, unless you save a report. Repository tokens are used once and never written anywhere.
Public beta for Macs with Apple Silicon.
The app is signed but not yet notarised by Apple, so macOS asks once:
Terminal alternative: xattr -dr com.apple.quarantine "/Applications/SecureCode Auditor.app"
Comp-sci-tech has removed this kind of malware from real repositories — every branch, pull request and developer machine — and verified the result. If you'd rather not do it alone, talk to us.
No. The code is read inside a sealed container on your own Mac. Nothing is uploaded to us — we don't run any server that receives your code or your results. The only optional exception is an AI you connect yourself, and the app shows you exactly what would be sent first.
The app is signed, but not yet notarised by Apple. macOS asks once for apps that aren't notarised; after you allow it in Privacy & Security it opens normally. You can check the download against the SHA-256 above.
That's the sealed sandbox: the code is opened inside a container with no network and no access to your files, so even malware written to escape has nowhere to go. There is deliberately no fallback that reads code directly on your Mac. The app ships its own sandbox image, so setup takes seconds.
Only on exact evidence — the fingerprint of a known payload, a campaign marker or a known infected file. Everything else is "needs review" with the evidence shown, never a guess dressed up as a verdict. And "nothing found" means nothing matched, not a guarantee.
No — it does a different job. Antivirus watches files on your computer; SecureCode Auditor audits source code and its whole Git history before you install, build or open a project.
Apple Silicon Macs first. Windows and Linux versions are planned.