Start free. Add depth when you need it.
The free tier covers OWASP Top 10 pattern matching across 23 checks plus a capped cross-file project scan (single-pass taint and cross-file detection on a changed-code slice, up to 50 files / 2 MB), self-serve sign-in with your work SSO. Pro adds two-pass interprocedural taint analysis, 31 heuristic flow checks, AI-context scanning, whole-repo scale plus OSV dependency scanning, and the full 1,998-rule library. Enterprise adds SSO controls, custom rules, audit logging, and SLAs.
Proof-backed coverage
23 OWASP Top 10 pattern checks plus a capped cross-file project scan: single-pass taint and cross-file detection (import chains, secret leakage, inconsistent auth, project structure) on a changed-code slice, up to 50 files / 2 MB. Deep two-pass taint, heuristics, and AI-context scanning are Pro.
- 23 free-tier checks, OWASP Top 10 pattern coverage, single-file
- Capped cross-file project scan, single-pass taint + import chains, cross-file secret leakage, inconsistent auth, project structure (PR-sized: up to 50 files / 2 MB)
- CRED-URL heuristic, hardcoded credentials in URLs (the one free heuristic)
- SQL/command/XSS/SSRF pattern detection
- Inline diagnostics in VS Code / Cursor
- Per-line ignore directives (
siteshadow:ignore=...) - Editor fix guidance and selected code actions
- WAF / edge-protection check (
POST /waf-check)
Full engine depth. Two-pass interprocedural taint analysis, 31 heuristic checks, AI scanning, whole-repo scale, and policy evaluation.
- 2,011 documented checks, all severities, OWASP + CWE
- Full taint engine, two-pass interprocedural across functions, helpers, and return values
- 31 heuristic checks, missing auth, timing attacks, mass assignment, prototype pollution
- AI context-aware scan, prompt injection, RAG poisoning, unsafe agent loops
- Whole-repo cross-file analysis, no PR-sized cap, plus OSV dependency CVE scanning (free covers a capped changed-code slice)
- Policy evaluation, fail/warn thresholds, CI exit codes
- GitHub Action with SARIF and PR comments
- Team dashboard and analytics
Everything in Pro with the security, compliance, and integration controls your organization requires.
- SSO, Azure AD via OIDC (Okta isn't available yet)
- Custom pattern rules, per-customer rule overrides (enable / disable / tune severity / add new rules) via the org config manifest
- Per-org configuration, rule overrides, severity tuning, allowlists
- Dedicated support, priority response, onboarding
- Audit logging, scan history, user activity
- SLA, uptime and response guarantees
"We found 2 vulnerabilities. Upgrade to see 5 more, including cross-function injection paths."
Side by side
| Capability | Free | Pro | Enterprise |
|---|---|---|---|
| Security checks | 23 | 1,998 | 1,998 + custom |
| Taint engine (interprocedural) | Single-pass | Two-pass | Two-pass |
| Cross-function taint flows | , | ✓ | ✓ |
| Heuristic checks (H01–H31) | , | ✓ | ✓ |
| AI / LLM security scan | , | ✓ | ✓ |
| Cross-file project scan | PR-sized (≤50 files / 2 MB) | Whole-repo | Whole-repo |
| Policy evaluation & CI exit codes | , | ✓ | ✓ |
| GitHub Action (SARIF + PR comments) | , | ✓ | ✓ |
| Team dashboard | , | ✓ | ✓ |
| SSO (Azure AD via OIDC; Okta isn't available yet) | , | , | ✓ |
| Custom pattern rules (per-org overrides) | , | , | ✓ |
| Per-org config & rule overrides | , | , | ✓ |
| Dedicated support & SLA | , | , | ✓ |
| Audit logging | , | , | ✓ |
| Inline diagnostics & fix guidance | ✓ | ✓ | ✓ |
Curious what these tiers actually catch? See a worked example end-to-end:
Questions?
Email hello@siteshadow.com and we'll reply with next steps.