2.9.22
Released 28 Oct 2026
Official SourceHarbor website
Source code scanner finds issues and suggests fixes you review.
SourceHarbor 2.9.22 is an autonomous agent for Windows 10/11 that scans code locally, and with a cloud model the prompt text goes to that provider. Local model keeps data.
Scan the current folder for hardcoded secrets and risky patterns, then fix the top three findings.
- glob
**/*.py12 files - grep
password3 matches - read_file
app/config.pyread - edit_file
app/config.py+2 lines - Shell
your test commandexit 0
waiting for your OK before the next stepRejectAccept
34 MB
Setup program size
25 MB
Single .exe file
13
Interface languages
Windows 10/11
x64 architecture
SHA-256
Verify installer file
Source code scanner for developers
This source code scanner works directly on your Windows machine and reads your files to find real issues in your codebase, while running commands to verify findings with actual exit codes. Ready now. Version 2.9.22 is ready for use on your system today. The setup program is about 34 MB and downloads fast.
Scan for secrets with a source code scanner
The agent maps your project using list_dir and glob to find all relevant files, then uses grep to search for common patterns like API keys or passwords. Fix it now. This source code scanning tools approach ensures you see the result before it is saved. Typical findings include credentials or keys written directly into code (CWE-798). When a match is found, read_file displays the surrounding code for context. You can then use edit_file to apply the fix in Ask first mode.
Tool trace
list_dir . → 12 files
grep password → 3 matches
read_file config.py → readRun your linter and tests
Shell runs your own linter and test command to confirm the fix did not change behaviour, while grep searches for patterns such as credential-like names in the code. Check results. read_file reads the code around a match so a person can judge it. edit_file applies a fix and the diff is shown before you accept. write_file creates a findings file to document the results clearly. The current version is 2.9.22 and it is released on 28 Oct 2026.
Tool trace
list_dir . -> lists project files
grep "password" *.cs -> finds 3 matches
read_file Program.cs -> shows line 42
edit_file Program.cs -> replaces secret with env var
Shell your linter -> exit code 0Search documentation with code security scanning tools
The agent uses web_search to find the official documentation and http_get to read the page for details about the specific weakness type, which is secure. This is secure. It helps you understand the specific weakness type clearly so you can fix it. You can then decide the best fix for your code. This method keeps your source code analysis grounded in facts and accuracy. Weak or outdated cryptographic algorithms (CWE-327) are common risks that need attention.
Fix issues with code security scanning tools
The agent identifies a risky pattern in your source code, and it uses edit_file to apply the fix while the diff is displayed for your review in Ask first mode. Diff reviewed. grep searches for patterns such as credential-like names so you can judge the match. read_file reads the code around a match to help you decide. The agent runs your test command to confirm the fix works without side effects. Code review for a C++ project requires careful attention to detail and 20 languages.
How it differs from a typical chat assistant
SourceHarbor version 2.9.22 addresses the serious need for code review and shows a diff before saving when in Ask first mode. Real results.
| Typical chat assistant | SourceHarbor | |
|---|---|---|
| Action | Suggests changes | Runs commands |
| Result | Shows text | Shows exit code |
| Editing | Generates text | Applies diff |
| Verification | Does not run your tests | Runs your test command |
How to install SourceHarbor
- Download the 34 MB setup file for Windows 10 or 11.
- Verify the SHA-256 checksum against the published manifest.
- Run the installer or the 25 MB portable .exe.
- Open the app and start scanning your code.
Who uses it and when
Developers use source code scanning tools to find secrets and risky patterns, and they verify the exit code to confirm whether a command passed, not that the code is good. Check findings. Prioritize vulnerabilities without drowning in alerts during source code review.
Security practitioners use it for detailed examination because they map large projects with list_dir and glob, and they search for risky patterns using grep to read the code and confirm the findings. No account needed. Thirteen languages available for the interface.
Teams use edit_file to fix vulnerabilities and they review the diff in Ask first mode before running tests to confirm the fix works properly with CWE-798. Add 256. The counter shows files created, edited and read during the process.
Frequently asked questions
What is a source code scanner?
A static analysis tool reads program code without running it to find hard-coded secrets and risky patterns, and it helps you identify issues before deployment. It is SAST. CWE-89 covers SQL text built by joining user input into a query string.
Is sourcecodesite.com the official SourceHarbor website?
Yes, sourcecodesite.com is the official SourceHarbor website, and the installer is downloaded from here so you must compare its SHA-256 checksum with the published manifest to verify integrity before running version 2.9.22. Verify first. Windows SmartScreen may warn you, so press Send feedback if you have issues.
How does the agent handle secrets?
Secrets in tool output are redacted before they reach the model endpoint you choose, so you must write the file and line number, never the value. Rotate immediately. Check the output for accuracy before proceeding with the next step.
What approval modes are available?
Approval modes are Auto-run, Ask first, and Plan only, which let you choose how the agent executes tasks and controls the workflow effectively and securely. Switch freely. Plans survive restarts and you can switch modes at any time during your workflow.
Where do the files stay?
The local working folder stores your chats, API keys, and secrets on your PC without sending telemetry to any external service. Files stay local. Chats remain on the PC for privacy while data stays secure and private.
Can it run on WSL or SSH?
Yes, the agent runs in local Windows, WSL, or SSH to a server you own, and file tools operate in the chat's working folder while shell commands execute in the chosen environment. You control the connection. Data stays local on your PC without sending secrets to the cloud.
How does it differ from a review?
Source code review means a person reads the code, while a scanner finds patterns, so they work best together to confirm findings for the team. Exactly right. Treat every finding as a lead for a person to confirm.
Start scanning your code
Download SourceHarbor 2.9.22. It runs tools and shows real results.
Download SourceHarbor for Windows ↗Explore more
Every page of this website is available in 20 languages. The app interface itself has 13 languages.
Product features ↗ Model configuration ↗ Workflow examples ↗ Download installer ↗ FAQ details ↗ Privacy policy ↗
