If you're submitting your app for a free Launch Readiness scan, your GitHub repo needs to be public — our scanner reads code the same way anyone browsing GitHub would, with no login, no special access, and nothing installed on your account. A private repo simply can't be reached from the outside, so the clone fails before a scan can even start.

Here's exactly how to make a repo public, and what to do first if you're not sure your code is clean.

Before you flip it to public

Making a repo public makes its entire history public too — not just the current code, but every commit ever pushed to it. If you've ever committed a real API key, database password, or .env file (even one you later deleted), it's still sitting in that history and anyone can find it.

  1. Run a free scan on your repo before making it public if you're not sure — our uploader also accepts a zip export, so you can check first without exposing anything.
  2. If you do find a real secret, rotate it (generate a new key and revoke the old one) rather than just deleting the file — deleting a file doesn't remove it from history.

Steps to make your repo public

  1. Go to your repository on github.com and click Settings (top right of the repo page — you need to be the owner or have admin access).
  2. Scroll all the way to the bottom to the Danger Zone section.
  3. Click Change visibility, then choose Change to public.
  4. GitHub will ask you to type the repository name to confirm — type it exactly as shown and confirm.

That's it — the repo is now public immediately. You can flip it back to private the same way once you're done, if you'd rather not leave it public long-term.

Now submit it for a free scan

Once your repo is public, head to our free scan page, paste the repo URL in, and we'll clone it, check it for security issues and bugs, and hand you back a private report — only you get the link.

FAQ

Will making my repo public hurt my business?

Not by itself — plenty of production apps have public source code. The real risk is committed secrets (API keys, passwords, tokens), which is exactly what a scan before you flip visibility is meant to catch.

Can I make it private again after the scan?

Yes, any time, the same way — Settings → Danger Zone → Change visibility.

What if I don't want to make it public at all?

Use the zip upload option on the scan page instead — export your project as a zip and upload it directly, no GitHub visibility change needed.