Free SAST for private repos — no per-developer seat tax

GitHub CodeQL is free for public repos. For private repos it's $49 per committer per month, and you need a GitHub Team or Enterprise plan. Snyk is $25/dev. Semgrep is $40/dev plus AI credits per finding. machin-secure is free — for private repos too, no enterprise plan, no seat tax, your code never leaves your CI runner.

If your company's code is in private GitHub repositories — and most companies' code is — here's what you're paying for static security analysis, or you're not running it at all:

• GitHub CodeQL: free for public repos, $49 per active committer per month for private repos, requires GitHub Team or Enterprise.
• Snyk Code: from $25 per developer per month (Team), ~$105/dev for Enterprise.
• Semgrep: from $40 per developer per month, plus AI credits — 1 credit per finding for AI triage, 20 credits per autofix.
• Amazon Inspector: billed per scan per repository per scan type.

A 50-developer team on private repos pays $1,250 to $2,450 per month, every month, forever — whether the tool finds 1 vulnerability or 1,000. The cost scales with headcount, not with value found. And the AI-powered parts that actually do the triage? Metered in credits, so they're the first thing that gets skipped when the budget tightens.

I built machin-secure because that math didn't work for me, and it probably doesn't work for you either. It's open source, it runs in your GitHub Actions on every push, it writes SARIF to your Security tab, and it costs zero — not a freemium tier, not "free up to 1000 files," not "free for public repos only." Free for private repos. No per-developer seat tax. No AI credits. No enterprise plan required.

What it is — and what it isn't

I'm going to be honest about this, because overselling a security tool is the worst thing you can do with one. machin-secure is regex-based SAST. 1000 rules across 25 languages, CWE-tagged, covering the OWASP Top 25 and the CWE Top 25. It catches hardcoded secrets, SQL injection patterns, weak crypto, disabled auth checks, insecure deserialization, the common stuff. It runs in seconds, writes SARIF, and gets out of the way.

What it doesn't do: taint tracking. Data flow analysis. SCA (dependency / known-CVE scanning). IDE integration. Autofix. Those are real capabilities that Snyk and CodeQL have and machin-secure doesn't. If you need data-flow taint analysis from source to sink across 17 function calls, use CodeQL — it's the right tool for that job, and it's free for public repos.

What machin-secure is: a fast, free first pass that runs on every push to every repo — including private ones — without billing you per developer. Think of it as the cheap deterministic layer that catches the obvious stuff before you spend money on the expensive tools, or instead of them for teams that can't justify $2,400/month on SAST.

The architecture, and why it's the point

The reason it's free isn't a pricing decision — it's an architectural one. Most AI security scanners put the LLM in the scan loop: every file is an inference call, every finding is a token burn. That's why they meter AI credits per finding — they're passing their inference cost through to you. It's also why the triage, which is the whole point of "AI-powered," is the first thing that gets gated when credits run low.

machin-secure inverts the split. The scan loop is deterministic and free — regex rules, no API calls, runs in CI on every push in seconds. The judgment — "is this finding real or a false positive for our codebase?" — is BYOK: your engineer or your agent triages the findings once, drops the noise with a verdict command, and that decision persists across scans. The expensive, judgment-heavy work happens once, out of band, on your budget. The cheap, deterministic work happens every push, in CI, for free.

No credits to burn. No per-finding metering. No vendor in the path between your code and your judgment.

Your code doesn't leave your CI

If you're in a regulated industry — finance, healthcare, EU under GDPR — this is the line that matters. A SaaS scanner sends your source code to a third party on every scan. machin-secure runs in your GitHub Actions runner, on your infrastructure. Your code touches two things: the open-source binary (which you can audit and pin to a version) and GitHub's own SARIF API. No third-party API. No telemetry. No "we train on your code" clause. The rule pack is a JSON file in the repo — you can read every pattern it runs.

For a CTO whose legal team asks "where does our code go?" — the answer is "nowhere." That's a short conversation, and it's the difference between a tool you can adopt in a week and one that spends six months in procurement.

It's fast enough to run on every push — I proved it on its own repo

A security tool that's too slow to run in CI is a security tool that doesn't exist. I hit this myself the week I shipped it: the first version hung for 39 seconds on its own repository — a 290 KB rule file with 12,872 lines, 292 applicable rules, 3.7 million regex calls. The CI job timed out and got killed. The tool that was supposed to catch vulnerabilities couldn't scan its own.

The fix was a per-rule literal pre-filter — before running the expensive regex, check if the line even contains the literal substring the pattern requires. Most lines don't. That cut regex calls by 85% and took the scan from 39 seconds to 6.8. The full-repo self-scan now runs in 12 seconds, and the CI self-scan — including binary download — passes in 21.

I'm telling you this not because the perf bug is interesting, but because it's the proof point. This tool scans its own repo on every push, in CI, in 21 seconds, for free. The bar for "runs on every push" isn't "fast enough on a demo repo" — it's "fast enough on the worst file in the repo, every time, without someone remembering to trigger it." That's the bar I held, and that's the bar it meets.

Why it's open source

Two reasons. The first is trust: a security tool you can't audit is a security tool you shouldn't run. The rules are public, the engine is public, the SARIF output is standard. If a finding looks wrong, you can read the exact pattern that produced it and decide for yourself. No black box. The whole tool is ~750 lines of source plus a JSON rule pack you can read in a text editor.

The second is the bet: the deterministic scan loop is a commodity. The value is in the judgment layer — the agent that triages findings, learns your codebase's false-positive patterns, and files verdicts that persist. That layer is where I'm building next, and it's where the real leverage is. The scanner is open source so it gets adopted; the judgment layer is where the product grows. If you're a CTO who wants to be early to that, the repo is here and I'm easy to reach.

Try it in 60 seconds

If you have a private GitHub repo and five minutes, you can have SARIF findings in your Security tab by the end of this paragraph. Copy the workflow from the README, push it, and watch the Security tab light up. No signup, no API key, no sales call, no procurement cycle. If it finds nothing, you've lost five minutes. If it finds something, you've found it before your attacker did — and you didn't pay $49 per developer to find out.

The tool is machin-secure. It's built with machin, the language I'm building at intrane.fr for agent-first tooling. If you're a CTO whose private repos aren't getting scanned because the seat tax doesn't pencil out — this one's free. For private repos too. Forever.