My company is giving away its security check for a month — here is what it actually looks at

Disclosure: I work at Knowverse, the company behind TechDD. This post is about our own event.

I'm not a developer. I sit next to the people who build our code-checking tools, and over the past few months I've watched them run the same three checks on almost every codebase that comes through the door. Small startups, solo builders, teams getting ready for investor due diligence — the same three problems keep showing up.

This month we have a reason to give that check away. Knowverse was selected for KAIST OverEdge Top 25, and to say thank you, our Security Triple Check is free from Nov 4 to Dec 3, 2026 (KST). It's normally $119.

But first, here's what the three checks are, and how you can run a basic version of each yourself today, for free.

1. Leaked secrets

API keys, database passwords and tokens that ended up in the code — or in the git history, even after someone deleted them from the current files. This is the one our engineers say people are most surprised by, because "I removed it last week" doesn't mean it's gone.

Try it yourself: gitleaks scans a repository, including its history.

gitleaks detect --source .

2. Vulnerable open-source dependencies

Most of a modern app is other people's code. If one of those packages has a known vulnerability, your app has it too, even if your own code is perfect.

Try it yourself: your package manager probably already has an audit command.

npm audit        # Node.js
pip-audit        # Python (pip install pip-audit)

3. Risky code patterns

Things like SQL queries built by gluing strings together, eval on user input, or TLS certificate checks switched off "just for testing" and never switched back on.

Try it yourself: Semgrep has free community rules for many languages.

semgrep scan --config auto

So why would you use ours?

Honestly, if you're comfortable running and reading the three tools above, you may not need it. What the Security Triple Check adds is one report that puts all three together and explains each finding in plain language, so it's easier to decide what to fix first. That's the part I personally find useful as a non-developer.

A few things people usually ask about their source code:

• It's analyzed only in an isolated environment.
• It's never sent to external AI services.
• It's deleted automatically when the assessment ends.

How the free check works

• Enter with your email and a company, team, or personal project name. Side projects are welcome.
• A free voucher goes onto your account right away. It's valid for 7 days.
• Upload your source code within those 7 days. The report arrives within 24 hours, in English.
• One entry per email account. No payment details.
• The only thing we ask in return: an honest review after you get your report. Criticism is welcome too.

👉 Enter for the free Security Triple Check

And a question for you, since I'm still learning: what's the one check you always run before you ship? I'd love to pass the answers on to our team.