Find the JWT and OAuth bugs hiding in your repo.

SecurAI scans your GitHub repository for JWT and OAuth vulnerabilities, ranks them by severity, and explains exactly how to fix each one.

$

public repos scan instantly · private repos require sign-in

securai scan
$ securai scan github.com/acme-co/payments-api
→ cloning repo… resolving 1,284 files
→ rule engine: 37 checks · ai review: enabled
✓ scan complete in 11.4s — 2 high, 2 medium, 1 low
highsrc/middleware/auth.js:42
JWT verified without an algorithm allowlist
42jwt.verify(token, secret);
↳ attacker can forge an alg:none token. pin algorithms: ["HS256"].

How it works

From repo URL to a fix list in under a minute.

01

Paste your repo URL

Point SecurAI at any public or connected GitHub repository. No agent to install, no config files to write.

02

Hybrid scan runs

A deterministic rule engine catches known auth anti-patterns; an AI review pass reasons about the surrounding code for context-dependent bugs.

03

Get a prioritized report

Findings ranked by severity, each with the exact file and line, why it's exploitable, and a copy-paste fix.

What it catches

The auth bugs that actually get exploited.

JWT-ALG-NONE

alg:none / algorithm confusion

Tokens verified without an algorithm allowlist accept alg:none forgeries and RS256→HS256 downgrades using the public key as the HMAC secret.

JWT-NO-EXP

Missing expiration check

Tokens decoded instead of verified — or signed without an exp claim — keep granting access forever, even after logout or revocation.

JWT-WEAK-SECRET

Weak or hardcoded secrets

Short, guessable, or source-committed signing secrets let anyone with repo access mint valid tokens for any user.

OAUTH-STATE-MISSING

Missing OAuth state parameter

Authorization flows without a validated state value are open to login CSRF — an attacker binds their code to a victim's session.

OAUTH-REDIRECT-URI

Unvalidated redirect_uri

Loose redirect_uri matching (open redirects, wildcard hosts, missing exact-match) leaks authorization codes and tokens to attacker-controlled URLs.

JWT-LOCALSTORAGE

Tokens in localStorage

Access tokens kept in localStorage are readable by any XSS on the page. HttpOnly, Secure, SameSite cookies keep them out of JavaScript's reach.

Trusted by engineering teams shipping auth

logo placeholder
logo placeholder
logo placeholder
logo placeholder

Customer logos and testimonials will go here.

Scan your repo. See what's exposed.

Drop in a GitHub URL and get a prioritized auth-security report with fixes you can ship today.

$
or