Terms

PreClone reads files and looks for known ways a repository can run code on your machine. It can't see everything: code can be hidden in ways no static check finds, and a repo can change after you check it. A report with nothing alarming in it means we found nothing, not that the repo is safe. Treat it as one input, and use a container or virtual machine for code you don't trust.

The service is provided as it is, without warranties of any kind. We aren't liable for damage caused by code you choose to run, whether or not a report flagged it.

• Only check repositories you're allowed to access. For private repos, use a token that belongs to you.
• Don't try to get around the limits, overload the service, or use it to download or mirror repositories.
• Reports describe what a repository contains and quote short excerpts of it. Don't present a report as a claim that a person or project acted in bad faith; findings are often innocent.
• We may suspend accounts or block networks that break these rules.

Keep your password and API tokens to yourself; anything done with them counts as done by you. Revoke a token in Settings as soon as you think it has leaked.

• Payments aren't switched on yet, so Pro is a free preview. It costs nothing, and you can end it any time from Billing.
• A preview never turns into a charge on its own. Paid Pro will need its own checkout, with the price shown first.

Reports of public repositories are unlisted: anyone with the link can read them. If you own a repository and think a report about it is wrong or unfair, tell us and we'll review it, fix the rule or take the report down.

We may update these terms as the service changes. If a change matters, we'll say so on this page before it takes effect.

Questions or requests: use “Report a problem” under any report and leave an email address if you'd like a reply.