How can an organization run a free Deep Scan?

Last updated: October 28, 2026

Context

CodeRabbit is covering up to $5,000 in free security scans and fixes per organization on a first come, first served, basis until 23:59:59 PST on November 8, 2026. Deep Scan is the part of CodeRabbit Secure that examines committed code, infrastructure configuration, and exposed secrets across an entire repository for security vulnerabilities. The scan maps the codebase, hunts for vulnerabilities across code paths, examines the safeguards already in place, and assesses whether each vulnerability can be reached and exploited. A verifier reopens the code and rejects any finding that the evidence does not support.

Answer

Any organization with two or more members can run a free Deep Scan. Advanced and Enterprise plans, including the 14-day Advanced trial, are eligible. The $5,000 is a usage allowance. Allowance that is not used is not available to cover Deep Scan usage after November 8, 2026. The offer ends before November 8, 2026 if the shared 1,000,000-credit usage limit is reached.

Prerequisites

  • Security Write access, which organization admins have by default.

  • GitHub, GitLab, Azure DevOps Services, and Bitbucket are supported providers. Azure DevOps Server is not supported.

  • If you're a new organization, connect your repository.

  • No credit card required.

How to run a free Deep Scan

  1. Sign in or create an account for an organization that is new to CodeRabbit.

  2. Open the Security page in the CodeRabbit app and select Run Deep Scan.

  3. Select a repository to connect and choose Full Scan. The repository that the team or community depends on most is a suitable starting point.

  4. Review the credit estimate and select Run Full Scan once more.

  5. Review the findings under Security > Findings when the scan completes. Larger repositories take longer to scan.

What happens after a scan

Each published finding includes supporting evidence and an assessment of reachability and exploitability. For eligible findings, CodeRabbit can draft a fix and propose in a pull request. A developer reviews, tests, and merges the change and remains responsible for what ships. Fixes are not applied automatically.

Deep Scan works alongside existing security tools and does not replace those tools.