CodeRabbit launches free Deep Scans for developers

CodeRabbit has launched free Deep Scans for any organisation and open-source project, committing USD $1 million to cover up to USD $5,000 of scanning per organisation.

The launch follows findings from CodeRabbit's security tools, which detected more than 8,000 high- or critical-severity vulnerabilities across 600 organisations in the past 30 days.

Broken access control, SQL injection and authentication failures accounted for more than 70% of the issues identified, according to the company. These are longstanding classes of software weakness that still appear in active codebases used by businesses and open-source projects.

CodeRabbit has also joined the OpenAI Daybreak Defence Network and plans to integrate OpenAI GPT cyber models into CodeRabbit Secure. The free offer applies to engineering teams that are not existing customers, as well as open-source maintainers.

The announcement reflects growing concern that software teams are producing and shipping code faster than they can inspect it manually. A June 2026 survey by New Relic, cited by CodeRabbit, found that 62% of technology leaders said their teams often release AI-generated code into production without line-by-line review.

Rising pressure

Recent incidents have added to that pressure. CodeRabbit pointed to emergency fixes for critical flaws in PHP, a separate round of security updates from Node.js, and Microsoft's report of a China-aligned group using agentic AI against more than 2,250 cloud tenants.

It also cited rapid exploitation after disclosure of the PHP2Shell vulnerability. In material accompanying the launch, CodeRabbit said Cloudflare saw hundreds of thousands of exploit attempts within two hours of disclosure.

Against that backdrop, CodeRabbit is offering what it describes as deeper, codebase-wide analysis rather than limiting checks to individual changes. Deep Scan reviews an entire codebase, identifies vulnerabilities, validates which flaws an attacker could reach, and produces a prioritised list of issues to fix, according to the company.

CodeRabbit added that the system can draft suggested fixes based on the standards already used in a codebase. That is intended to reduce the workload on engineering teams handling both discovery and remediation.

Older flaws

One issue highlighted by the company is the exposure of older code that may have remained untouched for years. It said attackers are using newer AI models to identify weaknesses in legacy code, including software components that are widely used across the industry.

Open-source software is a particular focus because it underpins much of modern development but often relies on small maintainer teams. CodeRabbit said most free security offers target open-source projects alone, while its programme also extends to commercial engineering teams.

Harjot Gill, Co-Founder and Chief Executive Officer of CodeRabbit, linked the move to wider changes in software production and attack methods. “AI made writing software abundant, but it broke our process to validate and trust it,” Gill said.

“Agents write more code than humans can review, opening up new vulnerabilities. And anyone with a credit card can now exploit them at scale. The attacks over the past week demonstrate that ensuring the security of code is now an urgent task for every engineering team. AI will find the exploit. CodeRabbit is here to help you find it first,” Gill said.

Partnership context

OpenAI's cyber-focused models are due to be integrated into Deep Scan through the Daybreak Defence Network. McCall McIntyre, Head of Global Cyber Partnerships at OpenAI, said the partnership is intended to help engineers identify exploitable flaws more quickly.

“Defenders need to find and fix vulnerabilities faster than attackers can exploit them,” McIntyre said.

“Through the Daybreak Defence Network, we're partnering with CodeRabbit to bring OpenAI GPT cyber models to Deep Scan, helping engineering teams find the flaws attackers could reach and fix them sooner. Making that available free to engineering teams and open-source maintainers helps strengthen the software we all depend on,” McIntyre said.

CodeRabbit Secure is available on the company's Advanced and Enterprise plans. CodeRabbit said it is used by more than 20,000 customers and more than 150,000 open-source projects worldwide.