Check your code.
Choose your route.

Manual Setup Studio builds a workflow file in your browser. You review it and add it to a repository so checks can run on GitHub Actions. The application-exposure option runs your configured build, so only use it with code you trust.

Cloud Scan Studio helps you create a separate scanner Codespace using your GitHub account. You still upload a project archive and run the audit in that workspace. Creating the workspace does not mean the scan has already run.

TriDelPhi’s software is free. GitHub runs the Codespace and may provide an included allowance, depending on your account. Usage beyond that allowance can cost money. Check your remaining allowance and spending controls before creating a workspace.

The studio asks for confirmation before creation. It cannot guarantee zero GitHub charges. See GitHub’s Codespaces billing guide.

The manual builder generates a workflow locally in your browser. Choosing its GitHub button sends the generated workflow to GitHub for you to review and commit—not your project’s source.

Cloud scan files live in your GitHub Codespace, not on the TriDelPhi website. GitHub’s access and retention rules apply there. The portal keeps temporary sign-in and workspace-creation metadata; it does not retain your source for training by default.

For a scan that stays on your computer, use the local command below. Optional external tools or database lookups have their own network behavior; the native local audit does not need them.

Read the affected file and the explanation before changing anything. A warning is a reason to investigate, not proof of an attack. If a real key was exposed, revoke or rotate it; deleting the text alone does not make that key safe.

If the scan says coverage is incomplete, resolve that limitation and run it again. Don’t read “no findings” as a guarantee. The rule reference explains what the checks look for.