Secrets
Gitleaks
API keys, tokens and private keys committed anywhere in the working tree, including files you forgot were there.
$ npx refact deploy
Ship your repo.
Skip the DevOps.
Refact reads your code, writes the Dockerfile and CI pipeline, scans for leaked secrets and vulnerable dependencies, then puts it online. You bring the GitHub link.
Free to start, no card. The first 100 signups get Pro free for 12 months.
Detected automatically
- Next.js
- React
- Vue
- Svelte
- Node.js
- Express
- Python
- Django
- Flask
- FastAPI
- Laravel
- Go
- Rails
- Docker
- Postgres
01 · The pipeline
One link in.
A running app out.
This is the actual path your code takes. Every stage is something Refact runs for you, and every one of them streams its logs while it happens.
refact — deploy
❯refact deploy github.com/yourname/storefront
- 01
Connect
Link GitHub and pick a repository. That is the only technical step, and it is the last decision we ask you to make.
- 02
Analyse
Refact clones the repo and reads it: language, framework, package manager, build and start commands, the port it listens on, whether it needs a database.
- 03
Scan
Gitleaks, Semgrep and a dependency audit run over the checkout. Critical findings block the deploy instead of shipping quietly, and each one comes with the fix.
- 04
Configure
A Dockerfile, a CI pipeline, a compose file and an environment template are written for your stack, then committed to your repo as a pull request you review.
- 05
Ship
The image builds, secrets are injected from the vault, the container starts, and traffic moves to it. Build logs stream live the whole way.
- 06
Watch
Every live app is checked on the minute. Uptime, response time and outages land on your dashboard, and the copilot explains them in plain English.
02 · Security
The deploy that should not
have shipped, doesn't.
Every release is scanned before it goes anywhere. A critical finding stops the pipeline. Not a warning in a log nobody reads, not an email after the fact.
Code
Semgrep
Injection, unsafe deserialisation, weak crypto and auth mistakes, matched against a curated ruleset for your language.
Dependencies
Audit
Known CVEs in your dependency tree, including transitive ones, resolved against the registry's patched releases.
Deploy blocked
$ refact deploy github.com/yourname/storefront
✓ Cloned · Detected Node 20 · Express
✕ CRITICAL — AWS key committed in config/aws.js:12
Rotate the key, then load it from an environment variable.
✕ CRITICAL — SQL injection in routes/search.js:38
Use a parameterised query instead of string concatenation.
Deploy halted. 2 critical issues must be fixed.
→ 2 fix pull requests ready to review
Findings become pull requests
Refact writes the patch: a rotated secret moved to an environment variable, a parameterised query, a dependency bumped to its patched release. Transitive vulnerabilities get an overrides entry, and anything crossing a major version is flagged rather than applied.
GitleaksSemgrepnpm auditpip-audit
03 · Copilot
Ask why, not
grep for it.
The copilot is grounded in your actual deployments: the build logs, the scan results, the uptime history. It answers about your app, not about deployment in general.
Why did my last build fail?What changed since the deploy that worked?Is anything down?Explain this CVE
You
Why is the app slower than yesterday?
Refact
Average response time moved from 118 ms to 340 ms after the deploy 6 hours ago (commit a3f9c2d). Uptime is still 100%. Nothing is failing, it is just slower. That release added the reporting endpoint, and every request to it is running an unindexed query. The previous version is still warm if you want to roll back while you add the index.
04 · Agents
Your agent can ship it.
Refact speaks MCP, so Claude or Cursor drives the same pipeline the dashboard does: analyse a repo, run the security scan, deploy it, read the build log back. The security gate applies to agents too. An agent cannot ship a critical finding either.
analyse_repositoryscan_repositorydeploy_repositoryset_secret
claude_desktop_config.json
{
"mcpServers": {
"refact": {
"url": "https://api.refact.app/mcp",
"headers": {
"Authorization": "Bearer <token>"
}
}
}
}05 · Features
Everything you would have had to build
Deploy
Push to deploy
Every commit to your branch builds and ships. Your live app tracks your latest commit.
Stack auto-detection
Node, Python, PHP, Go and Ruby stacks are read from the repo. There is no buildpack to pick.
Generated config
Dockerfile, CI workflow, compose file and env template, opened as a pull request you review.
Live build logs
Every stage streams as it happens, and the whole run is kept for later.
Secure
Three scanners
Secrets, static analysis and a dependency audit run on every deploy.
Blocking gate
Critical findings stop the release. Shipping a leaked key is not a warning.
Fix pull requests
One click turns a finding into a reviewed patch, including transitive dependency overrides.
Plain-English findings
Each issue explains the impact and the exact fix, not just a rule id.
Operate
Uptime monitoring
Every live app checked on the minute, with response-time history.
Secrets vault
Encrypted at rest, scoped per environment, injected at deploy time and never shown again.
Custom domains
Point a domain at any deployment; certificates are issued and renewed for you.
Agent access
Drive the whole pipeline from Claude or Cursor over MCP.
06 · The difference
What you stop doing
None of this is impossible by hand. It is just an afternoon each, per project, forever.
| Task | Wiring it yourself | With Refact |
|---|---|---|
| Work out the stack and write a Dockerfile | An afternoon, per project | Read from the repo |
| Wire up a CI pipeline | Copy-paste and debug YAML | Generated and committed |
| Scan for committed secrets | If you remember to | Every deploy, blocking |
| Audit dependencies for CVEs | A recurring chore | Every deploy, with fix PRs |
| Manage environment variables | A .env in a group chat | Encrypted vault |
| TLS and a domain | Certbot and a cron job | Issued and renewed |
| Know when it goes down | A user emails you | Checked every minute |
| Understand why it broke | Read the logs yourself | Ask the copilot |
07 · Pricing
Start free. Move up when it ships.
No card to start, and no charge for a deploy that failed.
[ Founding 100 ]
The first 100 signups get Pro free for 12 months.
Everything on this page, from the day we launch. No card now, and none until the year is up.
Free
For trying Refact out
£0/month
- 3 deployments per month
- Basic security scanner
- yourapp.refact.app subdomain
- Community support
Pro
PopularFor shipping side projects
£19/month
- Unlimited deployments
- Full security scanner
- Custom domain support
- Auto-deploy on push
- Uptime monitoring
- Rollback to any deploy
- Priority support
Team
For teams shipping together
£49/month
- Everything in Pro
- Up to 10 team members
- Preview environments
- Team deployment history
- Shared monitoring dashboard
- Priority support
Enterprise
For organisations at scale
Custom
- Everything in Team
- Unlimited team members
- Dedicated support
- Custom deployment limits
- Security review & SLA
- Onboarding assistance
08 · Questions
Before you connect a repo
- Do I have to change anything in my repo?
- No. Refact reads what is already there. The config it generates arrives as a pull request, so nothing lands in your repository without you approving the diff.
- What happens if the security scan fails?
- A critical finding stops the deploy. You get the file, the line, the impact and the fix, and usually a one-click pull request that applies it. Lower-severity findings are reported but do not block.
- Where does my app actually run?
- On a real provider: Render or Railway today, with more coming. Refact builds the image and drives their API, so there is no Refact-shaped lock-in around your app.
- How are my secrets stored?
- Encrypted with AES-256-GCM, scoped per environment, and sent straight to the provider at deploy time. The dashboard only ever shows a masked preview. There is no way to read a value back out.
- Can my AI agent use this?
- Yes. Refact speaks MCP, so Claude or Cursor can analyse a repo, run a scan, deploy it and read the build log back. It is the same pipeline the dashboard drives.
- Is my GitHub access read-only?
- Refact reads the repositories you pick and opens pull requests you approve. It never pushes to your default branch.
Your repo is already deployable.
Connect it and watch the pipeline run. If the scan fails, you will know exactly what to fix before anything goes live.