Nobody pastes a contract
into a website before a push.
The audit that runs on every commit — without your code leaving your runner.
But a check that appears on the pull request is in the team's way in the good sense, every working day. This runs the same detectors as the web scanner on every commit — inside your own runner, so the unreleased code stays on your machine.
Your source never leaves your machine
This is the part worth being precise about, because it is the objection that ends most conversations about a security scanner. The 201-detector engine is downloaded to your runner and executed there. What is posted back to SaferICO is a count per severity and a list of rule ids with file names and line numbers — never the code, and never the evidence strings, because those quote your source. The test suite asserts this by scanning the outgoing request body for fragments of the source it just scanned.
Privacy is the reason, not a side effect
For a team whose repository is private and unaudited, "paste your unreleased contract into someone else's API" is where it stops. Running in your runner removes that objection instead of arguing with it.
A Worker has 10ms of CPU
The engine needs far more than that on a real codebase. A GitHub runner has a full core and no time limit, so the scan that runs on your commit is the whole scan, not a reduced one.
Detectors update without touching your YAML
The runner fetches the current engine each run. A workflow pinned a year ago still gets today's detectors.
What is sold here is therefore not the computation — it is the licence, the history, the policy that decides whether a build fails, and the org-wide view. The detectors are already public at /sfi-engine.js and there is no pretending otherwise.
The whole setup
One file in .github/workflows/. Nothing is installed — the runner pulls no dependency tree, because a security tool that drags its own dependencies into your pipeline is arguing against itself.
name: Security
on: [push, pull_request]
jobs:
saferico:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: SaferICO security scan
run: curl -fsSL https://saferico.com/sfi-ci.mjs -o sfi-ci.mjs && node sfi-ci.mjs --sarif saferico.sarif
env:
SAFERICO_API_KEY: ${{ secrets.SAFERICO_API_KEY }}
# optional: findings appear on the Security tab and inline on the diff
- uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: saferico.sarif
Create the key on the API keys tab of your account and add it to your repository secrets. The optional last step uploads SARIF, so findings appear on GitHub's Security tab and inline on the diff — which is where a developer will actually read them.
The policy decides whether the build fails
Severities the engine reports: critical high medium low info
The default is fail on high — A build fails on any finding at or above this severity. Set it lower while you clear a backlog and raise it once you are clean; a threshold nobody can pass gets switched off within a week, and a check that is switched off protects nothing.
Getting started
CI scanning is part of the AI Agents plan at $59.9/month. The runner itself is a single file you can read before you run it: https://saferico.com/sfi-ci.mjs.