How the scan works
Dependency manifests only tell half the story. The scanner reads what your code actually calls.
Manifests first
package.json, requirements.txt, lockfile-free config — the installed SDKs are the fastest, strongest evidence, and the scan starts there.
Then the source itself
ASTAn AST pass resolves fetch and axios call sites, so a raw HTTP call to api.openai.com is detected even when no SDK is installed — the normal case in AI-generated code.
Env var names, never values
Names onlySTRIPE_SECRET_KEY proves Stripe even when the code hides it. Poliogo reads variable names only — values are never requested, logged, or stored.
Generated apps too
No repo in your workflow? No-code platforms connect through their GitHub sync, your hosting account, or a ZIP export — and the scanner reads what the generated code actually calls.
Evidence, weighted honestly
A dependency in package.json is a fact. A mention in your README is a question we ask you to confirm. Weak evidence never becomes a definitive claim in a document.
We keep almost nothing
PrivateAfter the scan we keep a short list of service names. Your source code is read in flight and never stored.
How it works
GitHub, GitLab, Bitbucket, a hosting account, a no-code platform, or a ZIP upload.
You get a plain-English list: every service, what it does, and what data it touches.
Nothing is written until you say yes. Add or remove anything on the list.
See what your product really uses
Free scan on one project — no credit card.
Start free — no credit cardPoliogo is a compliance management technology platform, not a law firm. Content provided does not constitute legal advice.