CodeRabbit Covers Up to $5,000 in Deep Scan Security Scans Per Organization
CodeRabbit is paying for security scans with its Deep Scan tool, covering up to $5,000 in usage for any organization with two or more members through November 8. The company says it has put up to $1 million behind the offer, which runs first come, first served until the money is gone.
- CodeRabbit covers up to $5,000 in Deep Scan usage per organization with two or more members.
- The offer runs through November 8, 2026, backed by up to $1 million, first come, first served.
- Deep Scan examines whole repositories and uses an independent verifier to reject findings the evidence does not support.
- CodeRabbit can draft fixes for eligible findings, but a developer reviews and remains responsible for what ships.
- The company says open-source maintainers are a main target of the campaign.
Who can claim the offer
According to CodeRabbit, the offer is open to any organization with two or more members. That includes open-source projects, current or former customers, and teams that have never used the product. CodeRabbit will cover eligible usage up to $5,000 per organization while the allocation remains.
To take part, a team signs in or creates an account, connects a repository, and runs Deep Scan. The company suggests starting with the repository that the team or community depends on most. The claim window closes on November 8, 2026.
What Deep Scan does
Deep Scan is part of CodeRabbit Secure. CodeRabbit describes it as a tool that hunts for vulnerabilities the way an attacker would, then independently verifies which ones are reachable and exploitable before reporting them to a team.
Unlike a check on the latest change, Deep Scan examines committed code across an entire repository. According to the company, it maps the codebase in detail, searches code paths for vulnerabilities, examines the safeguards already in place, and uses semantic analysis to judge whether a flaw can actually be exploited. If a path crosses linked repositories, it can use that context as well.
Before a finding reaches a team, an independent verifier reopens the code and rejects anything the evidence does not support. Each published finding includes supporting evidence and an assessment of reachability and exploitability, so teams can decide what deserves attention first.
- Deep Scan is meant to run alongside existing security tools, not replace them.
- CodeRabbit says it adds reasoning about first-party application logic and risks that only show up when code is read in context.
For eligible findings, CodeRabbit can draft a fix that follows the standards already used in the codebase. A developer reviews the proposed change and remains responsible for what ships, the company says.
Why CodeRabbit is paying for the scans
The company's argument is that developers are not the only ones using AI to make sense of unfamiliar code. CodeRabbit says attackers have access to the same AI models and can use them to search mature codebases for paths nobody has followed in years. In its view, teams need enough defensive capacity to examine their own code just as closely.
Open-source projects are a major reason for the campaign. CodeRabbit notes that companies rely on open-source software that is often maintained by small teams without dedicated security staff, and that a vulnerability in one widely used project can affect every organization depending on it. The company says it wants those maintainers to see what Deep Scan finds without budget being the reason they have to wait.
What it means for teams
For teams that have not scanned older code in depth, the offer lowers the cost of finding out what is exposed. Because the funding is limited to up to $1 million and is first come, first served, availability depends on how quickly organizations claim it. The source does not say how much a typical scan costs, so it is unclear how many organizations the pool will cover.
The offer also doubles as a way for CodeRabbit to put Deep Scan in front of teams that may not use its products today. Findings still require human judgment: developers review any drafted fix and decide what ships.
