CodeRabbit says Deep Scans found 1,215 high or critical flaws in 1,125 public repositories

CodeRabbit says its Deep Scan tool found 1,215 high or critical security issues across 1,125 public repositories between 23 October and 3 November 2026, and that at least 75 of them have since been fixed. The figures come from a CodeRabbit blog post by Santosh Yadav dated 13 November. Of the 1,215 findings, 1,200 are rated high and 15 critical.

CodeRabbit announced the results on X on 13 November, saying attackers have AI agents probing open-source code around the clock and that maintainers should have the same help. The post also offers a first Deep Scan free, up to US$1,000, to organisations with two or more people.

Attackers have AI agents probing open-source code 24/7 & we think maintainers should too!

CodeRabbit ran Deep Scans on 1,125 public repos with 1,215 high or critical findings, 75 of which are already fixed.

Your first Deep Scan is on us, up to $1K for orgs with 2+ people.

— CodeRabbit (@coderabbitai) November 13, 2026

What the scans covered

Deep Scan is part of CodeRabbit Secure. CodeRabbit’s security docs say it checks a repository’s source code and infrastructure configuration, including legacy code, rather than only the latest change. The blog says the scans came at no cost to the open-source community.

The post names one project, ast-grep. Its creator, Herrington Darkholme, says he tried Deep Scan on it and that proving a vulnerability before flagging it makes each finding more actionable. The post doesn’t list the other repositories.

How many are fixed

CodeRabbit puts the fixed count at “at least 75”. That’s about 6% of the 1,215 findings. The post gives no figure for the rest beyond the campaign total.

How a Deep Scan works

CodeRabbit describes four stages. Deep Scan maps the entry points, trust boundaries and access controls, hunts along the code paths for suspected flaws, and passes each one to a separate verifier. The verifier reopens the cited code and checks reachability and existing safeguards. For supported findings, a “Fix with AI” option sends the finding to CodeRabbit Agent, which prepares a patch and opens a pull request.

A person reviews and merges each fix. CodeRabbit’s security page says it never merges one on its own. CodeRabbit’s 26 October announcement says Deep Scan uses frontier AI models, including OpenAI’s GPT-6.1 Sol, and that CodeRabbit has joined the OpenAI Daybreak Defense Network.

What it found most

The post lists six of the most common problems. The first is a missing ownership check: an endpoint confirms a user is signed in but not that they’re allowed to see or change the specific record. CodeRabbit says that one is easy to miss in review because the sign-in check sits right there in the route.

The free offer

CodeRabbit says its earlier US$1 million Deep Scan promotion, which offered up to US$5,000 per organisation, has ended. In its place, open-source projects trying Deep Scan for the first time get one free scan covering up to US$1,000, and a project needs two or more members to qualify. The security page says Deep Scan is otherwise billed separately, with an estimate shown before each manual scan.

Projects can start at app.coderabbit.ai/security or email [email protected].