Last updated November 10, 2026
In short
- Uploading a lockfile, getting a price quote and reading public reports are free.
- Scanning new code takes a prepaid balance from $20 or a monthly subscription with a token budget. Both work with API keys.
- You only pay for files nobody has scanned before; identical code is reviewed once and reused for free.
What is free
- Parsing lockfiles and manifests, and price quotes.
- Public security reports for every package version already scanned, as HTML and Markdown.
- Scans where every file was already reviewed: the cached verdicts are reused at no cost.
Prepaid balance
Sign in with GitHub or Google and top up on the account page, by card, Apple Pay or Google Pay through Polar. The minimum top-up is $20, because each card charge has a fixed fee, and VAT or sales tax is added at checkout where it applies. A balance belongs to an account, so it is not anonymous.
- Each scan of new code is quoted first, then deducted at the quoted price. Cached files stay free.
- While a monthly plan is active, the plan pays for scans and the balance stays untouched. The balance pays once the plan's access has lapsed.
- The balance never expires, and unused balance is refundable from your account page.
- Scans the service fails on are returned to the balance.
- It works with API keys, so CI jobs and agents can scan unattended. Top-ups happen on the account page, not over the API.
- Automatic top-up is optional: when the balance falls below a level you set, your saved card is charged an amount you choose, plus VAT or sales tax, up to a limit per 30 days. You turn it on and off on the account page.
Monthly plans
Subscriptions give an account API keys and a monthly budget of LLM tokens for new code. Cached files never count against it. Pay by card, Apple Pay or Google Pay.
Starter
$30 per month
- 100M LLM tokens of new code per 30 days
- API keys for CI and scripts
- Cached files and public reports free
Team
$99 per month
- 350M LLM tokens of new code per 30 days
- API keys for CI and scripts
- Cached files and public reports free
Business
$249 per month
- 1B LLM tokens of new code per 30 days
- API keys for CI and scripts
- Cached files and public reports free
Scale
$1,999 per month
- 10B LLM tokens of new code per 30 days
- API keys for CI and scripts
- Cached files and public reports free
How billing works
- Merchant of record. Subscriptions and top-ups are sold through Polar Software, Inc. (polar.sh), which processes the payment, adds VAT or sales tax where required, and provides invoices and receipts. Card details go to Polar and its payment processor and never reach our servers.
- Renewal. Plans renew every month on the date you subscribed until you cancel.
- Cancelling. Cancel any time from the account page. Access continues until the end of the period you paid for.
- Upgrades and downgrades. An upgrade takes effect immediately and you pay the prorated difference for the rest of the period. A downgrade takes effect at the next renewal.
- Token budget. Usage is counted over a rolling 30 days. Unused tokens do not carry over.
- Sign-in. Sign in with GitHub or Google, then create API keys for CI and scripts.
Refunds are covered by the refund policy; use of the service by the terms of service and the privacy policy.
Frequently asked questions
What is an LLM token?
Source code is split into tokens before the AI model reads it; a token is roughly three to four characters of code. Plans count the tokens the review model reads and writes for files that had to be analyzed. Files that were already reviewed, by you or anyone else, are free and do not count.
Do I need an account to scan?
To scan code nobody has reviewed yet, yes: sign in with GitHub or Google and use a prepaid balance or a monthly plan. Both work with API keys. Getting a quote and reading public reports need no account.
What happens when I reach my plan's token limit?
Usage is counted over the last 30 days. A scan that would go over the limit is refused before it starts, so nothing is cut off halfway. Public reports stay free, and you can upgrade or wait as older usage drops out of the 30-day window. A prepaid balance is not used while a plan is active.
Can I cancel any time?
Yes. Cancel from the account page. The plan stays active until the end of the period you paid for and does not renew.
Who handles billing and tax?
Polar Software, Inc. (polar.sh) is the merchant of record for subscriptions and top-ups. It charges your card, Apple Pay or Google Pay, adds VAT or sales tax where required, and provides invoices and receipts in its customer portal.
Is there per-seat pricing?
No. A plan is a token budget shared by every API key on the account, however many developers or CI jobs use it.
How does the prepaid balance work?
Sign in with GitHub or Google and top up on the account page, by card, Apple Pay or Google Pay through Polar; VAT or sales tax is added at checkout where it applies. Each scan of new code is quoted first, then deducted at the quoted price. Cached files stay free. It works with API keys, so a CI job or an agent can scan unattended.
Why is the minimum top-up $20?
Because each card charge has a fixed fee.
Does the prepaid balance expire?
No. It never expires, unused balance is refundable from your account page, and scans the service fails on are returned to the balance.
Can I top up over the API?
No. Top-ups happen on the account page. API keys can spend the balance but not add to it. To keep CI running, turn on automatic top-up there: your saved card is charged when the balance falls below a level you set.