Frequently Asked Questions

Sekura is autonomous security testing. Its AI agents probe your code the way an attacker would and report only the weaknesses they could actually exploit — each one with a working proof and the fix.

A scanner gives you a long list of possible issues ranked by a score. Sekura confirms each finding by exploiting it, and reports only what it can prove. If something cannot be exploited in your environment, it is not reported — so there is no pile of maybes to triage.

Real. Each finding carries the exact request and response that demonstrate it, so you can check it yourself in a couple of minutes without taking our word for it.

In one pass it checks your application, its AI and model parts, and whether your cryptography would survive a future quantum computer. Those are surfaces most teams buy separate tools for and line up by hand.

Yes — on the enterprise plans. LiveScan and MasterScan test your live application, signed in, against the host you run. Because live testing touches a system you operate, it is enterprise-only: you contact us, provide VPN tunnel details, and sign an SLA and a liability release first. The self-serve paid plans test your code and a private lab copy of your application.

Sign in with GitHub, choose a repository, and Sekura runs the full test. Your first scan is free when you start it on sekura.ai; a scan started from a coding tool, the CLI or MCP is Sekura Once at $199.

Nothing, and one thing: sign in. No card, no company, no phone number. One repository, one code test.

No. For the self-serve plans Sekura runs on its own infrastructure. To scan continuously inside your own pipeline, you add one workflow file to your repository.

Yes — install the Sekura GitHub App on it and grant the repository. You can scan public repositories without the App.

Your report arrives within 24 hours, usually much sooner. While the scan runs, your dashboard shows which phase it is in, so you are never staring at a blank spinner.

Start with a free code scan. Sekura Once is a $199 one-off that also tests a private lab copy of your app. The monthly plans keep a repository checked on a schedule: Sekura Always ($20 a month, code test, weekly), ScanPlus Always ($100, adds a lab copy, weekly) and ScanPro Always ($300, adds a lab copy, daily). Live-application and network testing are enterprise plans — LiveScan and MasterScan.

A free code test of one repository, run once, no card. It is the quickest way to see a real report on your own code.

Two things, by plan: a regular cadence — weekly or daily — so a repository stays checked, and a test of a private lab copy of your application on ScanPlus, ScanPro and the enterprise plans. Every scan includes remediation guidance.

Yes, from your dashboard at any time. The monthly plans come with a 14-day free trial, so you get at least two scans before the first charge.

It is emailed to you, in the body of the message, at a verified address on your account. It also stays in your dashboard.

A summary first, including what was and was not checked. Then each finding in four parts: what a stranger could do in one plain sentence, the evidence that proves it, how it was confirmed, and the fix.

The full report and its proof are kept for 60 days so a failed delivery can be retried, then deleted. A short summary — findings by severity and how the scan was billed — stays after that.

It hands back the change. Depending on what you have granted, the fix arrives as a pull request in your repository, or as a patch inside the report for you to apply.

No. If Sekura cannot prove a finding by exploiting it, the finding is not reported.

It depends on the plan. On the free scan and the self-serve Once and Always plans, Sekura clones your repository into an isolated container on its own infrastructure, reads it, and destroys the container. Running Sekura in your own pipeline or on-premises, only the findings and the content sent to the model leave your environment.

No. It only ever reads your repositories; it never writes to them.

No. Sekura never uses your code to train models for other customers.

Deleting your account cancels any subscription in the same step and deletes your stored reports immediately. One record is kept: the authorization showing you permitted the testing — it is retained as legal evidence, and the privacy notice says so.

Sekura signs you in with GitHub and nothing else. The first time, GitHub shows its authorization page; after that, Sekura greets you by name and one click takes you in.

Yes. GitHub asks you to authorize Sekura once per account, then recognises you and sends you straight back. To see the page again, revoke Sekura under GitHub → Settings → Applications and sign in again.

Sekura shows whoever signed in last on this browser under Welcome back. Press the × on that row to forget it, or choose Use a different GitHub account. Switching signs you out of the first account; it does not join the two.

Do not sign in twice. Install the Sekura App on that account or organization, and its repositories appear in your existing Sekura account. On the scan page, Don’t see a repository? takes you there.

Sekura needs one email to send reports to. Under GitHub → Settings → Emails, make an address public or untick Keep my email addresses private, then sign in again.

Never for the Free Scan. Sekura Once is $199, paid once. The monthly plans — Sekura Always $20, ScanPlus $100, ScanPro $300 — take a card at purchase and start a 14-day free trial, so you get at least two scans before the first charge: one when you set it up, and one on the weekday you choose.

Yes, within 5 minutes of starting it. A scan that is cancelled, or that produces no report, does not spend your free scan.

A paid scan you cancel in its first 5 minutes, or one that fails, runs again at no charge: choose Run again at no charge from its menu on your dashboard. If you would rather have your money back, write to support and we will refund it.

From your dashboard, at any time: choose Cancel Always from the repository's menu. Its scheduled scans continue until the end of the period you have paid for.

Yes. On the developer tiers, additional target apps are $100 per target — once on Sekura Once, and per month on the Continuous plans that include the lab copy (ScanPlus, ScanPro). On the enterprise tiers, additional live target apps are $200 per target per month, and additional nodes are $200 per ten nodes per month.

The month you already paid for is honoured to its end.

Testing of your live application — signed in, against the host you run — and network security. The enterprise plans are LiveScan Always ($500 a month: code and live-application testing, daily) and MasterScan Always ($1,500 a month: adds network security and ten nodes, daily). On-premises deployment is available too.

The prices are published — LiveScan $500 a month, MasterScan $1,500 a month, extra nodes $200 per ten per month — but enterprise plans are not bought online. You contact us, provide VPN tunnel details, and sign an SLA and a liability release before any live testing runs.

The URL where your application runs, proof that you control that host, and a test account’s credentials, provided over a VPN tunnel. Sekura signs in as that test account and never changes its password, creates accounts or deletes anything.

Bring your own model key, or use ours. On-premises deployments include inference, so they do not come with a model-procurement problem attached.

Request a POC. Tell us what you are protecting and where it has to run, and the team follows up.

Claude Code, Cursor, GitHub Copilot, OpenAI Codex and nearly forty other coding tools, through its MCP server; Meta Muse, through a REST API; GitHub Actions and self-hosted runners; model providers including Anthropic Claude and OpenAI GPT (and private endpoints on Enterprise); and Slack, Teams, Jira, Outlook and Confluence for notifications and fixes. Every tool, and how to connect it.

Findings are mapped automatically to 14 compliance frameworks — SOC 2, ISO 27001, PCI DSS, HIPAA, NIST and more — so audit prep is a byproduct of every scan.

Yes, from Meta Muse and from the coding tools. Ask Muse to connect Sekura, or add Sekura as an MCP server in Claude Code, Cursor, Copilot or Codex; a sekura.ai page opens where you sign in with GitHub, install the App on the repositories you want scanned, and approve — there is no key to copy. The tool then does what your dashboard does, and every paid action is quoted to you and confirmed before anything happens. Connect a tool.

Yes. Sekura runs on your GitHub Actions runner; your source never leaves your repository, and only the findings come back.

Write to support@sekura.ai, or use the support panel in the product. A support assistant answers common questions and hands anything else to a person.

Most sign-in snags are GitHub verifying a new device or rate-limiting repeated sign-ins. Signing in at github.com first, then returning to Sekura, usually clears it. If it persists, contact support with the time of the attempt and the browser you used.