CodeRabbit’s October 24, 2026 offer would cover up to US$5,000 in Deep Scan usage for organizations with at least two members, including small software businesses and open-source teams.
The advertised window runs through November 8, 2026, but access is first-come, first-served within a shared allocation of up to US$1 million. Remaining funding and successful redemption for a particular account are unverified; the deadline is not a guarantee that coverage will remain available.
For maintainers, the opportunity is to investigate security risks in existing code with some costs covered. CodeRabbit describes Deep Scan as examining the wider codebase rather than only a proposed change. The useful decision is whether your team can act on the findings, not simply whether it can start a scan.
Who the published terms include
Current customers, former customers and newcomers are included in the advertised offer. The ceiling applies per organization, not per member.
These are the advertised eligibility terms. They do not specify the deadline’s cutoff time or timezone, or exactly how membership is counted. Start from the announcement’s claim link and confirm your organization’s allowance before running a scan.
Separate the scan allowance from other costs
CodeRabbit lists Deep Scan as an on-demand product. Its security product page says pricing depends on codebase size, so the dollar ceiling cannot be translated into a reliable number of repositories. Compare the estimate for the code you actually intend to scan.
Under the standard scan-billing rules, estimates account for eligible files and exclusions; final charges, when billing applies, reflect actual usage for completed or partial scans. After a free allowance is exhausted, usage billing must be enabled by someone with the appropriate subscription permission. Confirm how the promotion handles usage beyond its allowance before enabling paid billing.
Ongoing security review of proposed code changes is a different purchase. The Advanced subscription includes it at US$72 per developer per month with annual billing, or US$90 month-to-month; Deep Scan remains separately billed. The offer does not list an Advanced subscription as an eligibility condition. Likewise, regular free Team features for public open-source repositories do not establish unlimited free Deep Scans.
Runtime verification: optional tests to investigate findings use separately metered Agent minutes, not scan credits. Automatic verification is listed at up to US$6 per finding. It requires organization access and is documented for GitHub Cloud repositories on CodeRabbit Cloud; it is not available everywhere Deep Scan runs.
AI-assisted repairs: the initial Security Fix with AI turn is free under current coding-agent billing rules, where that feature is available. Asking the agent for revisions or further work normally starts paid turns. Administrators can set a separate monthly agent-spending cap.
The campaign announcement does not explicitly settle whether separately metered verification or paid coding follow-ups are covered. Check both before using them. In particular, automatic verification has a designated payer: the person launching a manual scan, or the person who last saved the verification setting for scheduled scans.
Choose a first scan your team can follow through
A practical way to assess the offer is to separate four decisions: scan the code, test a finding, request a repair and approve the resulting change. Covered scan usage does not settle the cost or authorization of the other steps.
Consider a limited pilot when an allowance is confirmed, the repository owner permits the connection and a named maintainer has time to review findings. Defer if nobody can investigate the results or approve fixes. Those are planning criteria, not additional eligibility rules.
Before connecting proprietary or client code, review the data terms with its owner. CodeRabbit’s privacy notice describes storage of some data for review improvement and an opt-out; do not assume a blanket no-retention promise.
Choose a repository whose purpose and deployment your reviewer understands. Deep Scan’s own scope and context settings let you describe important application boundaries and exclude files. Excluding files may reduce the estimate, but also narrows the assessment: record what was left out rather than treating the cheaper scan as equivalent coverage.
Read coverage details as well as findings. CodeRabbit’s documentation cautions that a completed scan can still have partial coverage and does not establish that a repository has no vulnerabilities. It also does not replace checks of third-party dependency packages or produce a software bill of materials, an inventory of software components.
Keep existing security checks running and review proposed patches before merging. OpenAI’s October 26 account of CodeRabbit’s security agent describes AI-proposed fixes with people responsible for what ships—not independently measured security gains. For a related supervision decision in another tool, see when to let Qwen Code fix a pull request.
The offer is most useful when it funds an investigation your team is ready to complete. Confirm the allowance, agree on any extra spending and reserve reviewer time before connecting the repository.