Key takeaways
- Parsing, the price quote, public reports and fully cached scans are free.
- A scan with new code is quoted first, then deducted from your balance at the quoted price.
- The smallest top-up is $20, by card, Apple Pay or Google Pay through Polar. The balance never expires, and unused balance is refundable from your account page.
- It needs an account (GitHub or Google sign-in) and works with API keys. Top-ups happen on the account page, not over the API.
- If you scan often, monthly plans start at $30 for 100M LLM tokens of new code per 30 days, with no per-seat pricing.
How a scan is priced
- You upload a lockfile or name a package. Parsing it is free.
- The server downloads every package and hashes each file with SHA-256. Files whose exact content anyone has scanned before reuse the stored verdict for free.
- The remaining files are priced by how much code they contain. You see the quote and a per-package breakdown before anything is deducted.
- If you go ahead, the scan is deducted from your balance at the quoted price. If nothing is new, nothing is deducted.
Because popular packages are scanned by many people, a typical re-scan after a few dependency updates only counts the files that changed. Get a quote for your own project on the scan page.
Topping up
Sign in with GitHub or Google, so a balance is tied to an account and is not anonymous. Top up on the account page by card, Apple Pay or Google Pay through Polar, with VAT or sales tax added at checkout where it applies. The smallest top-up is $20, because each card charge has a fixed fee.
- The balance never expires.
- Unused balance is refundable from your account page; see the refund policy.
- Scans the service fails on are returned to the balance.
Using it from CI and agents
An API key from your account spends the balance, so a CI job or an AI agent can scan without anyone present:
curl -X POST https://security.togoder.click/api/paid-scan \ -H "Authorization: Bearer $NPM_SCANNER_KEY" \ -F "file=@package-lock.json"
Top-ups themselves happen on the account page, not over the API. See scanning your lockfile in CI and the API guide.
Monthly plans, if you scan a lot
A monthly plan (card, Apple Pay or Google Pay) gives you API keys and a budget of LLM tokens of new code per 30 days: Starter $30/month for 100M, Team $99 for 350M, Business $249 for 1B and Scale $1,999 for 10B. Cached files use none of it, and there are no per-developer seats. While a plan is active it pays for scans and the balance stays untouched; the balance pays once the plan's access has lapsed. Set it up on the account page, and compare both on the pricing page.
What is free
- Every public report and the flagged packages tracker.
- Free API lookups of scanned versions and version ranges.
- Quotes, and any scan in which every file was scanned before.
How this compares
Most commercial supply chain tools (Socket, Snyk and others) offer a free tier and paid plans priced per developer per month. That suits teams that want continuous monitoring on every repository. A prepaid balance suits occasional audits, small teams, open-source maintainers and agents. See the comparison.
Frequently asked questions
Is there a dependency malware scanner without a subscription?
Yes. With Togoder Security you top up a prepaid balance from $20 and each scan of new code is deducted at its quoted price. Files that were scanned before stay free.
Do I need an account?
For a prepaid balance, yes: sign in with GitHub or Google. Quotes and public reports need no account.
Why is the smallest top-up $20?
Because each card charge has a fixed fee.
Does the balance expire?
No. It never expires, unused balance is refundable from your account page, and scans the service fails on are returned to the balance.
What does a scan cost?
It depends on how much code in your lockfile has never been scanned. The quote on the scan page is free and shows the price and a per-package breakdown before anything is deducted.