diff --git a/Directory.Packages.props b/Directory.Packages.props
index 107a44a..8d0c91f 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -8,6 +8,7 @@
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.11" />
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.11" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.11" />
     <!--
       Explicitly pins the transitive OpenAPI.NET dependency above the patched 2.x floor
       for GHSA-v5pm-xwqc-g5wc. No project directly references this package.
diff --git a/src/DevSecOpsSentinel.Api/Endpoints/PublicScanEndpoints.cs b/src/DevSecOpsSentinel.Api/Endpoints/PublicScanEndpoints.cs
new file mode 100644
index 0000000..f113de9
--- /dev/null
+++ b/src/DevSecOpsSentinel.Api/Endpoints/PublicScanEndpoints.cs
@@ -0,0 +1,74 @@
+using DevSecOpsSentinel.Application;
+using Microsoft.AspNetCore.Mvc;
+
+namespace DevSecOpsSentinel.Api.Endpoints;
+
+/// <summary>
+/// Scan any public repository's workflows by name, anonymously.
+///
+/// This deliberately amends the middleware's "no outbound call" justification for
+/// anonymous access: this endpoint does call out, and the amended boundary is
+/// stated rather than implied — api.github.com and raw.githubusercontent.com
+/// only, no credential attached, read-only by construction, results cached so a
+/// visitor cannot spend the unauthenticated GitHub quota one refresh at a time.
+/// Private repositories cannot appear here: an anonymous request cannot see them,
+/// which is why this path needs no allowlist while /api/github does.
+/// </summary>
+public static class PublicScanEndpoints
+{
+    public static WebApplication MapPublicScanEndpoints(this WebApplication app)
+    {
+        app.MapGet(
+            "/api/public-scan/{owner}/{repository}",
+            async (
+                string owner,
+                string repository,
+                IPublicRepositoryScanner scanner,
+                CancellationToken cancellationToken) =>
+            {
+                PublicScanResult result =
+                    await scanner.ScanAsync(owner, repository, cancellationToken);
+
+                return result.Status switch
+                {
+                    PublicScanStatus.Completed or PublicScanStatus.NoWorkflows =>
+                        Results.Ok(result),
+
+                    PublicScanStatus.InvalidName => Results.BadRequest(new ProblemDetails
+                    {
+                        Title = "Invalid repository name",
+                        Detail = result.Detail,
+                        Status = StatusCodes.Status400BadRequest
+                    }),
+
+                    PublicScanStatus.RepositoryNotFound => Results.NotFound(new ProblemDetails
+                    {
+                        Title = "Repository not found",
+                        Detail = result.Detail,
+                        Status = StatusCodes.Status404NotFound
+                    }),
+
+                    PublicScanStatus.QuotaExhausted => Results.Json(
+                        new ProblemDetails
+                        {
+                            Title = "GitHub quota exhausted",
+                            Detail = result.Detail,
+                            Status = StatusCodes.Status503ServiceUnavailable
+                        },
+                        statusCode: StatusCodes.Status503ServiceUnavailable),
+
+                    _ => Results.Json(
+                        new ProblemDetails
+                        {
+                            Title = "GitHub unavailable",
+                            Detail = result.Detail,
+                            Status = StatusCodes.Status502BadGateway
+                        },
+                        statusCode: StatusCodes.Status502BadGateway)
+                };
+            })
+            .RequireRateLimiting("workflow-analysis");
+
+        return app;
+    }
+}
diff --git a/src/DevSecOpsSentinel.Api/Program.cs b/src/DevSecOpsSentinel.Api/Program.cs
index eca9ade..3f39ed1 100644
--- a/src/DevSecOpsSentinel.Api/Program.cs
+++ b/src/DevSecOpsSentinel.Api/Program.cs
@@ -174,6 +174,21 @@
     client.Timeout = TimeSpan.FromSeconds(30);
 });
 
+// The anonymous public-repository scanner. A separate named client from "GitHub" on
+// purpose: that one carries an installation token, this one must never carry anything.
+// GitHub rejects requests without a User-Agent, and asking for the JSON media type keeps
+// the contents API's answers stable.
+builder.Services.AddHttpClient("GitHubPublic", client =>
+{
+    client.BaseAddress = new Uri("https://api.github.com");
+    client.Timeout = TimeSpan.FromSeconds(30);
+    client.DefaultRequestHeaders.UserAgent.ParseAdd("DevSecOpsSentinel");
+    client.DefaultRequestHeaders.Accept.ParseAdd("application/vnd.github+json");
+});
+
+builder.Services.AddSingleton(TimeProvider.System);
+builder.Services.AddSingleton<IPublicRepositoryScanner, PublicRepositoryScanner>();
+
 builder.Services.AddSingleton<
     IGitHubPrivateKeySource,
     GitHubPrivateKeySource>();
@@ -279,6 +294,7 @@
 app.MapStatusEndpoints(openAiOptions, gitHubOptions)
    .MapGitHubEndpoints(gitHubOptions)
    .MapCatalogueEndpoints()
+   .MapPublicScanEndpoints()
    .MapWorkflowEndpoints(maximumWorkflowCharacters);
 
 app.Run();
diff --git a/src/DevSecOpsSentinel.Application/PublicScanContracts.cs b/src/DevSecOpsSentinel.Application/PublicScanContracts.cs
new file mode 100644
index 0000000..bb4defb
--- /dev/null
+++ b/src/DevSecOpsSentinel.Application/PublicScanContracts.cs
@@ -0,0 +1,69 @@
+using DevSecOpsSentinel.Domain;
+
+namespace DevSecOpsSentinel.Application;
+
+/// <summary>
+/// Scan of a public repository's workflows, requested by name alone.
+///
+/// This is the one feature that makes an outbound call on behalf of an anonymous
+/// visitor, so its boundaries are the point: only api.github.com and
+/// raw.githubusercontent.com are contacted, no credential is attached, nothing is
+/// written, and results are cached so a popular repository costs one fetch rather
+/// than one per visitor. Private repositories are invisible to it by construction —
+/// an unauthenticated request cannot see them, which is the whole reason this needs
+/// no allowlist while the GitHub App integration does.
+/// </summary>
+public interface IPublicRepositoryScanner
+{
+    Task<PublicScanResult> ScanAsync(
+        string owner,
+        string repository,
+        CancellationToken cancellationToken);
+}
+
+public enum PublicScanStatus
+{
+    /// <summary>Workflows were fetched and analysed.</summary>
+    Completed,
+
+    /// <summary>The repository does not exist, or is private — indistinguishable
+    /// without credentials, and deliberately reported the same way.</summary>
+    RepositoryNotFound,
+
+    /// <summary>The repository exists but has no workflow files.</summary>
+    NoWorkflows,
+
+    /// <summary>The owner or repository name is not a name GitHub could accept.</summary>
+    InvalidName,
+
+    /// <summary>GitHub's unauthenticated quota for this host is exhausted.</summary>
+    QuotaExhausted,
+
+    /// <summary>GitHub answered with something unexpected.</summary>
+    GitHubUnavailable
+}
+
+/// <summary>One workflow file and what the deterministic rules made of it.</summary>
+public sealed record PublicScanFile(
+    string FileName,
+    string HtmlUrl,
+    WorkflowAnalysisResult Analysis);
+
+public sealed record PublicScanResult(
+    string Owner,
+    string Repository,
+    PublicScanStatus Status,
+    string? Detail,
+    IReadOnlyList<PublicScanFile> Files,
+    int SkippedFiles,
+    DateTimeOffset FetchedAtUtc,
+    bool FromCache)
+{
+    public static PublicScanResult Failure(
+        string owner,
+        string repository,
+        PublicScanStatus status,
+        string detail,
+        DateTimeOffset atUtc) =>
+        new(owner, repository, status, detail, [], 0, atUtc, FromCache: false);
+}
diff --git a/src/DevSecOpsSentinel.Infrastructure/DevSecOpsSentinel.Infrastructure.csproj b/src/DevSecOpsSentinel.Infrastructure/DevSecOpsSentinel.Infrastructure.csproj
index 9db84ac..476873c 100644
--- a/src/DevSecOpsSentinel.Infrastructure/DevSecOpsSentinel.Infrastructure.csproj
+++ b/src/DevSecOpsSentinel.Infrastructure/DevSecOpsSentinel.Infrastructure.csproj
@@ -11,6 +11,7 @@
   <ItemGroup>
     <PackageReference Include="OpenAI" />
     <PackageReference Include="Microsoft.Extensions.Http" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
     <PackageReference Include="YamlDotNet" />
   </ItemGroup>
   <ItemGroup>
diff --git a/src/DevSecOpsSentinel.Infrastructure/GitHub/PublicRepositoryScanner.cs b/src/DevSecOpsSentinel.Infrastructure/GitHub/PublicRepositoryScanner.cs
new file mode 100644
index 0000000..09382dc
--- /dev/null
+++ b/src/DevSecOpsSentinel.Infrastructure/GitHub/PublicRepositoryScanner.cs
@@ -0,0 +1,227 @@
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json.Serialization;
+using System.Text.RegularExpressions;
+using DevSecOpsSentinel.Application;
+using DevSecOpsSentinel.Domain;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging;
+
+namespace DevSecOpsSentinel.Infrastructure.GitHub;
+
+/// <summary>
+/// Fetches a public repository's workflows without credentials and runs the
+/// deterministic analysis over them.
+///
+/// The quota is the design constraint. GitHub allows 60 unauthenticated API
+/// requests per hour per source address, shared by every visitor this host
+/// serves — so the directory listing is the only call that spends it. File
+/// bodies come from raw.githubusercontent.com, which is not metered, and every
+/// outcome is cached, including the failures: a repository that does not exist
+/// is an answer worth remembering too, or one stranger retrying a typo drains
+/// the hour for everyone.
+/// </summary>
+public sealed partial class PublicRepositoryScanner(
+    IHttpClientFactory httpClientFactory,
+    IWorkflowAnalysisService analysisService,
+    IMemoryCache cache,
+    TimeProvider clock,
+    ILogger<PublicRepositoryScanner> logger) : IPublicRepositoryScanner
+{
+    /// <summary>
+    /// Enough for the overwhelming majority of repositories (the field scan's
+    /// median was well under it) while bounding the work a single request can
+    /// cause. Files beyond the cap are counted, not silently dropped.
+    /// </summary>
+    internal const int MaximumWorkflowFiles = 30;
+
+    /// <summary>Matches the request-body limit the analyze endpoint enforces.</summary>
+    internal const int MaximumWorkflowCharacters = 100_000;
+
+    private static readonly TimeSpan SuccessTtl = TimeSpan.FromMinutes(10);
+    private static readonly TimeSpan NotFoundTtl = TimeSpan.FromMinutes(2);
+    private static readonly TimeSpan QuotaTtl = TimeSpan.FromSeconds(90);
+
+    [GeneratedRegex("^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$")]
+    private static partial Regex OwnerPattern();
+
+    [GeneratedRegex(@"^[A-Za-z0-9._-]{1,100}$")]
+    private static partial Regex RepositoryPattern();
+
+    public async Task<PublicScanResult> ScanAsync(
+        string owner,
+        string repository,
+        CancellationToken cancellationToken)
+    {
+        DateTimeOffset now = clock.GetUtcNow();
+
+        // Validated before anything else touches them: these two strings become a
+        // URL path on a host we chose, and the pattern is what keeps them from
+        // becoming anything more interesting than a repository name.
+        if (!OwnerPattern().IsMatch(owner) || !RepositoryPattern().IsMatch(repository))
+        {
+            return PublicScanResult.Failure(
+                owner,
+                repository,
+                PublicScanStatus.InvalidName,
+                "Owner and repository must be plain GitHub names.",
+                now);
+        }
+
+        string key = $"public-scan:{owner.ToLowerInvariant()}/{repository.ToLowerInvariant()}";
+        if (cache.TryGetValue(key, out PublicScanResult? cached) && cached is not null)
+        {
+            return cached with { FromCache = true };
+        }
+
+        PublicScanResult result = await FetchAndAnalyzeAsync(owner, repository, now, cancellationToken);
+
+        cache.Set(key, result, result.Status switch
+        {
+            PublicScanStatus.Completed or PublicScanStatus.NoWorkflows => SuccessTtl,
+            PublicScanStatus.QuotaExhausted => QuotaTtl,
+            _ => NotFoundTtl
+        });
+
+        return result;
+    }
+
+    private async Task<PublicScanResult> FetchAndAnalyzeAsync(
+        string owner,
+        string repository,
+        DateTimeOffset now,
+        CancellationToken cancellationToken)
+    {
+        HttpClient client = httpClientFactory.CreateClient("GitHubPublic");
+
+        string listingPath =
+            $"/repos/{Uri.EscapeDataString(owner)}/{Uri.EscapeDataString(repository)}/contents/.github/workflows";
+
+        using HttpResponseMessage listing = await client.GetAsync(listingPath, cancellationToken);
+
+        if (IsQuotaExhausted(listing))
+        {
+            logger.LogWarning(
+                "GitHub unauthenticated quota exhausted while listing workflows.");
+            return PublicScanResult.Failure(
+                owner,
+                repository,
+                PublicScanStatus.QuotaExhausted,
+                "GitHub limits anonymous lookups per hour for this host, and the "
+                + "budget is spent. Cached results are unaffected; try again shortly.",
+                now);
+        }
+
+        if (listing.StatusCode == HttpStatusCode.NotFound)
+        {
+            // A missing repository and a repository with no .github/workflows both
+            // 404 here. One more request could tell them apart, but it would double
+            // the quota cost of every typo, so the listing's answer is refined only
+            // when it succeeds and the distinction is reported honestly otherwise.
+            return PublicScanResult.Failure(
+                owner,
+                repository,
+                PublicScanStatus.RepositoryNotFound,
+                "No public repository with workflows was found under that name. "
+                + "Private repositories are invisible to an anonymous scan.",
+                now);
+        }
+
+        if (!listing.IsSuccessStatusCode)
+        {
+            logger.LogWarning(
+                "GitHub listing returned {StatusCode}.",
+                (int)listing.StatusCode);
+            return PublicScanResult.Failure(
+                owner,
+                repository,
+                PublicScanStatus.GitHubUnavailable,
+                $"GitHub answered {(int)listing.StatusCode} for the workflow listing.",
+                now);
+        }
+
+        ContentItem[] items =
+            await listing.Content.ReadFromJsonAsync<ContentItem[]>(cancellationToken) ?? [];
+
+        ContentItem[] workflows =
+        [
+            .. items
+                .Where(item => string.Equals(item.Type, "file", StringComparison.OrdinalIgnoreCase))
+                .Where(item =>
+                    item.Name.EndsWith(".yml", StringComparison.OrdinalIgnoreCase) ||
+                    item.Name.EndsWith(".yaml", StringComparison.OrdinalIgnoreCase))
+                .Where(item => !string.IsNullOrWhiteSpace(item.DownloadUrl))
+                .OrderBy(item => item.Name, StringComparer.OrdinalIgnoreCase)
+        ];
+
+        if (workflows.Length == 0)
+        {
+            return PublicScanResult.Failure(
+                owner,
+                repository,
+                PublicScanStatus.NoWorkflows,
+                "The repository exists but .github/workflows contains no workflow files.",
+                now);
+        }
+
+        int skipped = 0;
+        List<PublicScanFile> files = [];
+
+        foreach (ContentItem item in workflows)
+        {
+            if (files.Count >= MaximumWorkflowFiles || item.Size > MaximumWorkflowCharacters)
+            {
+                skipped++;
+                continue;
+            }
+
+            // download_url points at raw.githubusercontent.com, which does not
+            // count against the API quota — the reason one scan costs one metered
+            // request no matter how many workflows the repository has.
+            string content = await client.GetStringAsync(item.DownloadUrl, cancellationToken);
+            if (content.Length > MaximumWorkflowCharacters)
+            {
+                skipped++;
+                continue;
+            }
+
+            WorkflowAnalysisResult analysis = await analysisService.AnalyzeAsync(
+                new WorkflowDocument(item.Name, content),
+                cancellationToken);
+
+            files.Add(new PublicScanFile(item.Name, item.HtmlUrl, analysis));
+        }
+
+        return new PublicScanResult(
+            owner,
+            repository,
+            PublicScanStatus.Completed,
+            Detail: null,
+            files,
+            skipped,
+            now,
+            FromCache: false);
+    }
+
+    private static bool IsQuotaExhausted(HttpResponseMessage response)
+    {
+        if (response.StatusCode is not (HttpStatusCode.Forbidden or HttpStatusCode.TooManyRequests))
+        {
+            return false;
+        }
+
+        // GitHub reports quota exhaustion as 403 with a zeroed remaining-count
+        // header; a plain 403 without it is something else and falls through to
+        // the generic unavailable path via the success-status check.
+        return response.Headers.TryGetValues("X-RateLimit-Remaining", out IEnumerable<string>? values) &&
+               values.FirstOrDefault() == "0" ||
+               response.StatusCode == HttpStatusCode.TooManyRequests;
+    }
+
+    private sealed record ContentItem(
+        [property: JsonPropertyName("name")] string Name,
+        [property: JsonPropertyName("type")] string Type,
+        [property: JsonPropertyName("size")] long Size,
+        [property: JsonPropertyName("html_url")] string HtmlUrl,
+        [property: JsonPropertyName("download_url")] string? DownloadUrl);
+}
diff --git a/src/devsecops-sentinel-web/src/App.tsx b/src/devsecops-sentinel-web/src/App.tsx
index e1bbda9..eab3248 100644
--- a/src/devsecops-sentinel-web/src/App.tsx
+++ b/src/devsecops-sentinel-web/src/App.tsx
@@ -16,6 +16,7 @@ import {
   getScenarios,
   getRemediationReport,
   downloadRemediationExport,
+  getPublicScan,
 } from './api';
 import type {
   AiStatus,
@@ -29,10 +30,11 @@ import type {
   WorkflowExplanationResult,
   WorkflowFinding,
   RemediationReport,
+  PublicScanResult,
 } from './models';
 
 const severityOrder = ['Critical', 'High', 'Medium', 'Low'];
-type SourceMode = 'simulation' | 'github';
+type SourceMode = 'simulation' | 'github' | 'public';
 type ResultTab = 'findings' | 'remediation' | 'comparison' | 'advisor';
 
 function getRiskLabel(findings: WorkflowFinding[]) {
@@ -83,6 +85,8 @@ function App() {
   const [selectedWorkflowPath, setSelectedWorkflowPath] = useState('');
   const [gitHubSource, setGitHubSource] = useState<GitHubWorkflowFile | null>(null);
   const [remediation, setRemediation] = useState<RemediationReport | null>(null);
+  const [publicRepoInput, setPublicRepoInput] = useState('');
+  const [publicScan, setPublicScan] = useState<PublicScanResult | null>(null);
 
   useEffect(() => {
     getSecurityStatus()
@@ -119,9 +123,18 @@ function App() {
 
   useEffect(() => {
     if (sourceMode !== 'simulation' || !selectedId) return;
+    // The guard above runs when the effect starts; the promise resolves later,
+    // by which point the user may have switched tabs and produced results this
+    // callback would wipe. Cancellation makes the stale response a no-op — the
+    // public-scan tests caught exactly that clobber.
+    let cancelled = false;
     getScenario(selectedId).then((scenario) => {
+      if (cancelled) return;
       setFileName(scenario.fileName); setContent(scenario.content); resetResults();
-    }).catch((reason: unknown) => setError(reason instanceof Error ? reason.message : 'Scenario could not be loaded.'));
+    }).catch((reason: unknown) => {
+      if (!cancelled) setError(reason instanceof Error ? reason.message : 'Scenario could not be loaded.');
+    });
+    return () => { cancelled = true; };
   }, [selectedId, sourceMode]);
 
   useEffect(() => {
@@ -199,11 +212,19 @@ function App() {
     resetResults();
   }
 
-  function resetResults() { setResult(null); setExplanation(null); setRemediation(null); setActiveResultTab('findings'); setError(''); }
+  function resetResults() { setResult(null); setExplanation(null); setRemediation(null); setPublicScan(null); setActiveResultTab('findings'); setError(''); }
 
   async function submit(event: React.FormEvent) {
     event.preventDefault(); setIsLoading(true); setError(''); setResult(null); setExplanation(null); setRemediation(null); setActiveResultTab(includeAi ? 'advisor' : 'findings');
     try {
+      if (sourceMode === 'public') {
+        const [owner, ...rest] = publicRepoInput.trim().replace(/^https?:\/\/github\.com\//i, '').split('/');
+        const repository = rest.join('/').replace(/\/.*$/, '') || rest[0];
+        if (!owner || !repository) throw new Error('Enter a repository as owner/name, e.g. facebook/react.');
+        setPublicScan(await getPublicScan(owner, repository));
+        setMobilePane('results');
+        return;
+      }
       if (sourceMode === 'github') {
         if (!selectedRepository || !selectedWorkflowPath) throw new Error('Select a GitHub workflow first.');
         const [owner, repository] = selectedRepository.split('/');
@@ -302,6 +323,7 @@ function App() {
     <div className="source-switcher" role="tablist" aria-label="Workflow source">
       <button type="button" role="tab" aria-selected={sourceMode === 'simulation'} className={sourceMode === 'simulation' ? 'active' : ''} onClick={() => { setSourceMode('simulation'); resetResults(); }}>Simulation</button>
       <button type="button" role="tab" aria-selected={sourceMode === 'github'} className={sourceMode === 'github' ? 'active' : ''} onClick={() => { setSourceMode('github'); resetResults(); }}>GitHub Sandbox <span className="read-only-tag">READ ONLY</span></button>
+      <button type="button" role="tab" aria-selected={sourceMode === 'public'} className={sourceMode === 'public' ? 'active' : ''} onClick={() => { setSourceMode('public'); resetResults(); }}>Public repo <span className="read-only-tag">NO SIGN-IN</span></button>
     </div>
 
     {/* Phone only; CSS hides it once both panes fit side by side. */}
@@ -317,9 +339,13 @@ function App() {
     </div>
 
     <section className="workspace" data-mobile-pane={mobilePane}><form className="control-panel" onSubmit={submit}>
-      <div className="panel-heading"><div><span className="panel-kicker">Analysis workspace</span><h2>{sourceMode === 'github' ? 'GitHub workflow' : 'Workflow input'}</h2></div><span className={`mode-pill ${sourceMode === 'github' ? 'mode-pill-readonly' : 'mode-pill-safe'}`}>{sourceMode === 'github' ? 'Read only' : 'Simulation'}</span></div>
+      <div className="panel-heading"><div><span className="panel-kicker">Analysis workspace</span><h2>{sourceMode === 'github' ? 'GitHub workflow' : sourceMode === 'public' ? 'Public repository' : 'Workflow input'}</h2></div><span className={`mode-pill ${sourceMode === 'simulation' ? 'mode-pill-safe' : 'mode-pill-readonly'}`}>{sourceMode === 'github' ? 'Read only' : sourceMode === 'public' ? 'Anonymous' : 'Simulation'}</span></div>
 
-      {sourceMode === 'simulation' ? <>
+      {sourceMode === 'public' ? <>
+        <label htmlFor="public-repo">Public repository</label>
+        <input id="public-repo" placeholder="owner/repository — e.g. facebook/react" value={publicRepoInput} onChange={(event) => setPublicRepoInput(event.target.value)} autoComplete="off" spellCheck={false} />
+        <p className="scenario-description">Every workflow under .github/workflows is fetched anonymously and run through the deterministic rules. Nothing is written, no credential is attached, and results are cached for ten minutes — a popular repository costs one fetch, not one per visitor.</p>
+      </> : sourceMode === 'simulation' ? <>
         <label htmlFor="scenario">Sample scenario</label><select id="scenario" value={selectedId} onChange={(event) => setSelectedId(event.target.value)}>{scenarios.map((scenario) => <option key={scenario.id} value={scenario.id}>{scenario.name}</option>)}</select>
         {selectedScenario && <p className="scenario-description">{selectedScenario.description}</p>}
         <label htmlFor="file-name">Workflow file</label><input id="file-name" value={fileName} onChange={(event) => setFileName(event.target.value)} />
@@ -330,16 +356,34 @@ function App() {
         {gitHubSource && <div className="source-metadata"><span>Branch <strong>{gitHubSource.defaultBranch}</strong></span><span>SHA <code>{gitHubSource.sha.slice(0, 10)}</code></span><a href={gitHubSource.htmlUrl} target="_blank" rel="noreferrer">View on GitHub</a></div>}
       </>}
 
+      {sourceMode !== 'public' && <>
       <div className="editor-label-row"><label htmlFor="workflow">Workflow YAML</label><span>{content.length.toLocaleString()} characters</span></div>
       <div className="editor-shell"><div className="editor-toolbar"><span className="editor-dot" /><span className="editor-dot" /><span className="editor-dot" /><strong>{fileName}</strong>{sourceMode === 'github' && <span className="editor-readonly">READ ONLY</span>}</div><textarea id="workflow" value={content} onChange={(event) => setContent(event.target.value)} spellCheck={false} readOnly={sourceMode === 'github'} aria-describedby="workflow-help" /></div>
 
       <div className="ai-control-card"><label className="ai-toggle" htmlFor="include-ai"><input id="include-ai" type="checkbox" aria-label="Include AI explanation" checked={includeAi} onChange={(event) => setIncludeAi(event.target.checked)} disabled={aiStatus?.enabled === false} /><span><strong>Include AI explanation</strong><small>Explain confirmed findings and remediation steps.</small></span></label><span className="mode-pill">{aiModeLabel}</span></div>
       <p id="workflow-help" className="helper-text">{sourceMode === 'github' ? 'The selected GitHub workflow is retrieved and analyzed without modifying the repository.' : 'Live AI mode sends sanitized context; Mock mode uses no credits.'}</p>
-      <button className="primary-action" type="submit" disabled={isLoading || content.trim().length === 0 || (sourceMode === 'github' && !selectedWorkflowPath)}>{isLoading ? <><span className="spinner" aria-hidden="true" />Loading…</> : sourceMode === 'github' ? 'Analyze GitHub workflow' : 'Analyze workflow'}</button>
+      </>}
+      <button className="primary-action" type="submit" disabled={isLoading || (sourceMode === 'public' ? !publicRepoInput.includes('/') : content.trim().length === 0 || (sourceMode === 'github' && !selectedWorkflowPath))}>{isLoading ? <><span className="spinner" aria-hidden="true" />Loading…</> : sourceMode === 'github' ? 'Analyze GitHub workflow' : sourceMode === 'public' ? 'Scan public repository' : 'Analyze workflow'}</button>
       {error && <p className="error" role="alert">{error}</p>}
     </form>
 
-    <section className="results" aria-live="polite">{!result && !error && <div className="empty-state"><div className="empty-icon" aria-hidden="true">✓</div><h2>{sourceMode === 'github' ? 'Select a GitHub workflow' : 'Ready to analyze'}</h2><p>{sourceMode === 'github' ? 'Choose an allowlisted repository and workflow. DevSecOps Sentinel will read and analyze it without making repository changes.' : 'Select a scenario or edit the YAML, then run the scanner.'}</p></div>}
+    <section className="results" aria-live="polite">{sourceMode === 'public' && publicScan && <>
+      <div className="summary-grid">
+        <article className="metric-card"><span>Repository</span><strong>{publicScan.owner}/{publicScan.repository}</strong><small>{publicScan.fromCache ? 'Cached result' : 'Fetched live'}</small></article>
+        <article className="metric-card"><span>Workflows scanned</span><strong>{publicScan.files.length}</strong><small>{publicScan.skippedFiles > 0 ? `${publicScan.skippedFiles} skipped (size/cap)` : 'All within limits'}</small></article>
+        <article className="metric-card"><span>With findings</span><strong>{publicScan.files.filter((file) => file.analysis.findings.length > 0).length}</strong><small>{publicScan.files.filter((file) => file.analysis.findings.length === 0).length} clean</small></article>
+        <article className="metric-card"><span>Total findings</span><strong>{publicScan.files.reduce((sum, file) => sum + file.analysis.findings.length, 0)}</strong><small>Deterministic rules only</small></article>
+      </div>
+      {publicScan.status === 'NoWorkflows' && <div className="success-card"><strong>The repository has no workflow files.</strong><span>{publicScan.detail}</span></div>}
+      {publicScan.files.map((file) => <section className="findings-panel" key={file.fileName}>
+        <div className="section-heading"><div><span className="panel-kicker">{file.analysis.findings.length === 0 ? 'Clean' : getRiskLabel(file.analysis.findings)} · {file.analysis.findings.length} finding{file.analysis.findings.length === 1 ? '' : 's'}</span><h2>{file.fileName}</h2></div><a className="result-badge" href={file.htmlUrl} target="_blank" rel="noreferrer">View on GitHub</a></div>
+        {file.analysis.findings.length === 0
+          ? <div className="success-card"><strong>No configured rule violations were detected.</strong><span>This workflow passed all deterministic checks.</span></div>
+          : severityOrder.flatMap((severity) => file.analysis.findings.filter((finding) => finding.severity === severity)).map((finding) => <article className={`finding finding-${finding.severity.toLowerCase()}`} key={`${file.fileName}-${finding.ruleId}-${finding.lineNumber}`}><div className="finding-heading"><span className={`severity severity-${finding.severity.toLowerCase()}`}>{finding.severity}</span><code>{finding.ruleId}</code>{finding.lineNumber && <span>Line {finding.lineNumber}</span>}</div><h3>{finding.title}</h3><p>{finding.description}</p><div className="recommendation"><strong>Recommended remediation</strong><span>{finding.recommendation}</span></div></article>)}
+      </section>)}
+    </>}
+    {sourceMode === 'public' && !publicScan && !error && <div className="empty-state"><div className="empty-icon" aria-hidden="true">✓</div><h2>Scan any public repository</h2><p>Enter owner/repository. Every workflow file is fetched read-only and analyzed; private repositories are invisible to an anonymous scan.</p></div>}
+    {sourceMode !== 'public' && <>{!result && !error && <div className="empty-state"><div className="empty-icon" aria-hidden="true">✓</div><h2>{sourceMode === 'github' ? 'Select a GitHub workflow' : 'Ready to analyze'}</h2><p>{sourceMode === 'github' ? 'Choose an allowlisted repository and workflow. DevSecOps Sentinel will read and analyze it without making repository changes.' : 'Select a scenario or edit the YAML, then run the scanner.'}</p></div>}
       {result && <><div className="summary-grid"><article className="metric-card"><span>Risk level</span><strong className={`risk-${riskLabel.toLowerCase().replace(' ', '-')}`}>{riskLabel}</strong><small>Deterministic findings</small></article><article className="metric-card"><span>Total findings</span><strong>{result.findingCount ?? findings.length}</strong><small>{countBySeverity(findings, 'Critical')} critical · {countBySeverity(findings, 'High')} high</small></article><article className="metric-card"><span>Auto-fixes</span><strong>{result.patch?.appliedRuleIds.length ?? 0}</strong><small>Proposed only</small></article><article className="metric-card"><span>Source</span><strong>{sourceMode === 'github' ? 'GitHub' : 'Local'}</strong><small>{sourceMode === 'github' ? 'Read-only retrieval' : 'Simulation scenario'}</small></article></div>
         <nav className="result-tabs" aria-label="Analysis result sections"><button type="button" className={activeResultTab === 'findings' ? 'active' : ''} onClick={() => setActiveResultTab('findings')}>Findings <span>{result.findingCount}</span></button><button type="button" disabled={!remediation} className={activeResultTab === 'remediation' ? 'active' : ''} onClick={() => setActiveResultTab('remediation')}>Remediation plan</button><button type="button" className={activeResultTab === 'comparison' ? 'active' : ''} onClick={() => setActiveResultTab('comparison')}>Workflow comparison</button><button type="button" disabled={!explanation} className={activeResultTab === 'advisor' ? 'active' : ''} onClick={() => setActiveResultTab('advisor')}>AI advisor</button></nav>
         {activeResultTab === 'findings' && <section className="findings-panel"><div className="section-heading"><div><span className="panel-kicker">Authoritative results</span><h2>Deterministic findings</h2></div><span className="result-badge">{result.findingCount === 0 ? 'Compliant' : 'Action required'}</span></div>{result.findings.length === 0 ? <div className="success-card"><strong>No configured rule violations were detected.</strong><span>The workflow passed all deterministic security checks.</span></div> : sortedFindings.map((finding) => <article className={`finding finding-${finding.severity.toLowerCase()}`} key={`${finding.ruleId}-${finding.lineNumber}`}><div className="finding-heading"><span className={`severity severity-${finding.severity.toLowerCase()}`}>{finding.severity}</span><code>{finding.ruleId}</code>{finding.lineNumber && <span>Line {finding.lineNumber}</span>}{finding.isAutomaticallyFixable && <span className="auto-fix-label">Proposed fix available</span>}</div><h3>{finding.title}</h3><p>{finding.description}</p><div className="recommendation"><strong>Recommended remediation</strong><span>{finding.recommendation}</span></div></article>)}</section>}
@@ -355,7 +399,7 @@ function App() {
           <strong>The model was not used.</strong> {explanation.explanation.fallbackReason} The explanation below is deterministic text derived from the findings.
         </p>}{explanation.sensitiveContentRedacted && <p className="warning">Potentially sensitive values were redacted.</p>}<div className="advisor-summary"><span className="panel-kicker">Executive summary</span><p>{explanation.explanation.summary}</p></div>{explanation.explanation.findings.map((item) => <article className="ai-finding" key={item.ruleId}><header><code>{item.ruleId}</code><span>{item.confidence} confidence</span></header><p><strong>Why it matters</strong>{item.whyItMatters}</p><p><strong>Recommended action</strong>{item.recommendedAction}</p></article>)}</section>}
         {activeResultTab === 'comparison' && result.patch && <><div className="readonly-banner"><strong>Preview only</strong><span>Phase D does not write this patch back to GitHub.</span></div><div className="comparison"><CodePanel title="Original workflow" subtitle="Repository content" content={result.patch.originalContent} tone="original" /><CodePanel title="Proposed workflow" subtitle="Validated remediation preview" content={result.patch.proposedContent} tone="proposed" /></div></>}
-      </>}
+      </>}</>}
     </section></section>
   </main>;
 }
diff --git a/src/devsecops-sentinel-web/src/PublicScan.test.tsx b/src/devsecops-sentinel-web/src/PublicScan.test.tsx
new file mode 100644
index 0000000..be7bbd9
--- /dev/null
+++ b/src/devsecops-sentinel-web/src/PublicScan.test.tsx
@@ -0,0 +1,147 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import App from './App';
+
+/**
+ * Public repository scanning: type owner/repository, get per-file findings,
+ * no key involved.
+ *
+ * The regression worth guarding is the feature quietly requiring something —
+ * a key, a paste, a second step. Its entire value is that it asks for a name
+ * and nothing else.
+ */
+const scenario = { id: 'sample', name: 'Sample', description: 'Sample', fileName: 'sample.yml' };
+
+const publicMode = {
+  required: false,
+  headerName: 'X-API-Key',
+  sessionOnlyBrowserKey: true,
+  mode: 'Public',
+  keyUnlocksGitHub: true,
+  keyUnlocksLiveAi: true,
+};
+
+const scanResult = {
+  owner: 'octo',
+  repository: 'app',
+  status: 'Completed',
+  detail: null,
+  files: [
+    {
+      fileName: 'ci.yml',
+      htmlUrl: 'https://github.com/octo/app/blob/main/.github/workflows/ci.yml',
+      analysis: {
+        fileName: 'ci.yml',
+        isValid: true,
+        validationErrors: [],
+        findings: [
+          {
+            ruleId: 'GHA001',
+            severity: 'High',
+            title: 'Action reference is not pinned to a commit SHA',
+            description: 'A movable tag can resolve to different code.',
+            lineNumber: 8,
+            recommendation: 'Pin the action to a full commit SHA.',
+            isAutomaticallyFixable: true,
+          },
+        ],
+        patch: null,
+        findingCount: 1,
+      },
+    },
+    {
+      fileName: 'release.yml',
+      htmlUrl: 'https://github.com/octo/app/blob/main/.github/workflows/release.yml',
+      analysis: {
+        fileName: 'release.yml',
+        isValid: true,
+        validationErrors: [],
+        findings: [],
+        patch: null,
+        findingCount: 0,
+      },
+    },
+  ],
+  skippedFiles: 0,
+  fetchedAtUtc: '2026-08-24T00:00:00Z',
+  fromCache: false,
+};
+
+function respond(handlers: Record<string, () => Response>) {
+  return async (input: RequestInfo | URL): Promise<Response> => {
+    const url = String(input);
+    if (url === '/api/security/status') return Response.json(publicMode);
+    if (url === '/api/scenarios') return Response.json([scenario]);
+    if (url === '/api/scenarios/sample') return Response.json({ ...scenario, content: 'name: Sample\non:\n  push:\n' });
+    if (url === '/api/ai/status') return Response.json({ enabled: true, configured: false, provider: 'OpenAI', mode: 'Mock', model: 'gpt-5-mini', costProtection: { explicitRequestOnly: true, mockModeConsumesCredits: false } });
+    if (url === '/api/github/status') return Response.json({ enabled: false, configured: false, connected: false, mode: 'ReadOnly', allowedRepositoryCount: 0, message: 'Not configured.' });
+    for (const [prefix, handler] of Object.entries(handlers)) {
+      if (url.includes(prefix)) return handler();
+    }
+    return new Response('{}', { status: 404 });
+  };
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  sessionStorage.clear();
+});
+
+describe('Public repository scan', () => {
+  beforeEach(() => {
+    vi.stubGlobal('fetch', vi.fn(respond({
+      '/api/public-scan/octo/app': () => Response.json(scanResult),
+    })));
+  });
+
+  it('scans by name and shows per-file findings without any key', async () => {
+    render(<App />);
+    await waitFor(() => expect(screen.getByRole('tab', { name: /Public repo/ })).toBeInTheDocument());
+
+    fireEvent.click(screen.getByRole('tab', { name: /Public repo/ }));
+    fireEvent.change(screen.getByLabelText('Public repository'), { target: { value: 'octo/app' } });
+    fireEvent.click(screen.getByRole('button', { name: 'Scan public repository' }));
+
+    await waitFor(() => expect(screen.getByText('ci.yml')).toBeInTheDocument());
+
+    // The vulnerable file shows its finding; the clean file says so.
+    expect(screen.getByText('Action reference is not pinned to a commit SHA')).toBeInTheDocument();
+    expect(screen.getByText('release.yml')).toBeInTheDocument();
+    expect(screen.getByText('No configured rule violations were detected.')).toBeInTheDocument();
+
+    // And the whole path involved no key gate.
+    expect(screen.queryByText('Access key required')).not.toBeInTheDocument();
+  });
+
+  it('accepts a pasted github.com URL, not only owner/name', async () => {
+    render(<App />);
+    await waitFor(() => expect(screen.getByRole('tab', { name: /Public repo/ })).toBeInTheDocument());
+
+    fireEvent.click(screen.getByRole('tab', { name: /Public repo/ }));
+    fireEvent.change(screen.getByLabelText('Public repository'), {
+      target: { value: 'https://github.com/octo/app' },
+    });
+    fireEvent.click(screen.getByRole('button', { name: 'Scan public repository' }));
+
+    await waitFor(() => expect(screen.getByText('ci.yml')).toBeInTheDocument());
+  });
+
+  it('surfaces the problem detail when the repository is not found', async () => {
+    vi.stubGlobal('fetch', vi.fn(respond({
+      '/api/public-scan/octo/gone': () =>
+        Response.json(
+          { title: 'Repository not found', detail: 'No public repository with workflows was found under that name.', status: 404 },
+          { status: 404 }),
+    })));
+
+    render(<App />);
+    await waitFor(() => expect(screen.getByRole('tab', { name: /Public repo/ })).toBeInTheDocument());
+
+    fireEvent.click(screen.getByRole('tab', { name: /Public repo/ }));
+    fireEvent.change(screen.getByLabelText('Public repository'), { target: { value: 'octo/gone' } });
+    fireEvent.click(screen.getByRole('button', { name: 'Scan public repository' }));
+
+    await waitFor(() => expect(
+      screen.getByText('No public repository with workflows was found under that name.')).toBeInTheDocument());
+  });
+});
diff --git a/src/devsecops-sentinel-web/src/api.ts b/src/devsecops-sentinel-web/src/api.ts
index 7b6c9ec..6c89303 100644
--- a/src/devsecops-sentinel-web/src/api.ts
+++ b/src/devsecops-sentinel-web/src/api.ts
@@ -1,5 +1,6 @@
 import type {
   AiStatus,
+  PublicScanResult,
   ApiSecurityStatus,
   ScenarioDetail,
   ScenarioSummary,
@@ -185,3 +186,26 @@ export async function downloadRemediationExport(fileName: string, content: strin
   anchor.click();
   URL.revokeObjectURL(url);
 }
+
+export async function getPublicScan(
+  owner: string,
+  repository: string,
+): Promise<PublicScanResult> {
+  const response = await apiFetch(
+    `/api/public-scan/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}`,
+  );
+
+  if (!response.ok) {
+    // The API answers failures with problem details whose detail is written
+    // for a person - the quota message, the not-found message. Surface it
+    // rather than a status code.
+    const problem = (await response.json().catch(() => null)) as
+      | { detail?: string; title?: string }
+      | null;
+    throw new Error(
+      problem?.detail ?? problem?.title ?? `Scan failed (${response.status}).`,
+    );
+  }
+
+  return (await response.json()) as PublicScanResult;
+}
diff --git a/src/devsecops-sentinel-web/src/models.ts b/src/devsecops-sentinel-web/src/models.ts
index 14d0b9a..ad6691f 100644
--- a/src/devsecops-sentinel-web/src/models.ts
+++ b/src/devsecops-sentinel-web/src/models.ts
@@ -146,3 +146,20 @@ export interface RemediationReport {
   resolvedFindingCount: number;
   remainingFindingCount: number;
 }
+
+export interface PublicScanFile {
+  fileName: string;
+  htmlUrl: string;
+  analysis: WorkflowAnalysisResult;
+}
+
+export interface PublicScanResult {
+  owner: string;
+  repository: string;
+  status: 'Completed' | 'RepositoryNotFound' | 'NoWorkflows' | 'InvalidName' | 'QuotaExhausted' | 'GitHubUnavailable';
+  detail: string | null;
+  files: PublicScanFile[];
+  skippedFiles: number;
+  fetchedAtUtc: string;
+  fromCache: boolean;
+}
diff --git a/tests/DevSecOpsSentinel.Api.Integration.Tests/PublicScanEndpointTests.cs b/tests/DevSecOpsSentinel.Api.Integration.Tests/PublicScanEndpointTests.cs
new file mode 100644
index 0000000..9a92e21
--- /dev/null
+++ b/tests/DevSecOpsSentinel.Api.Integration.Tests/PublicScanEndpointTests.cs
@@ -0,0 +1,118 @@
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using DevSecOpsSentinel.Application;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+
+namespace DevSecOpsSentinel.Api.Integration.Tests;
+
+/// <summary>
+/// The endpoint's job is translation: scanner outcomes to status codes, without the
+/// endpoint inventing behaviour of its own. The scanner is stubbed, so what these
+/// tests pin is exactly that mapping — including that the route accepts an anonymous
+/// caller, which is the property the feature exists for.
+/// </summary>
+public sealed class PublicScanEndpointTests : IClassFixture<PublicScanEndpointTests.Factory>
+{
+    private readonly HttpClient _client;
+
+    public PublicScanEndpointTests(Factory factory) => _client = factory.CreateClient();
+
+    [Fact]
+    public async Task Completed_scan_returns_ok_with_the_findings()
+    {
+        HttpResponseMessage response = await _client.GetAsync("/api/public-scan/octo/app");
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        // The API writes enums as strings; the reader has to agree with it.
+        JsonSerializerOptions options = new(JsonSerializerDefaults.Web)
+        {
+            Converters = { new JsonStringEnumConverter() }
+        };
+        PublicScanResult? result =
+            await response.Content.ReadFromJsonAsync<PublicScanResult>(options);
+        Assert.NotNull(result);
+        Assert.Equal(PublicScanStatus.Completed, result.Status);
+        Assert.Single(result.Files);
+    }
+
+    [Fact]
+    public async Task Missing_repository_maps_to_not_found()
+    {
+        HttpResponseMessage response = await _client.GetAsync("/api/public-scan/octo/missing");
+
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Exhausted_quota_maps_to_service_unavailable()
+    {
+        HttpResponseMessage response = await _client.GetAsync("/api/public-scan/octo/quota");
+
+        Assert.Equal(HttpStatusCode.ServiceUnavailable, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Invalid_name_maps_to_bad_request()
+    {
+        HttpResponseMessage response = await _client.GetAsync("/api/public-scan/octo/bad");
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    public sealed class Factory : WebApplicationFactory<Program>
+    {
+        protected override void ConfigureWebHost(IWebHostBuilder builder)
+        {
+            builder.UseEnvironment("Testing");
+            builder.ConfigureServices(services =>
+            {
+                services.RemoveAll<IPublicRepositoryScanner>();
+                services.AddSingleton<IPublicRepositoryScanner, StubScanner>();
+            });
+        }
+    }
+
+    private sealed class StubScanner : IPublicRepositoryScanner
+    {
+        public Task<PublicScanResult> ScanAsync(
+            string owner,
+            string repository,
+            CancellationToken cancellationToken)
+        {
+            DateTimeOffset now = DateTimeOffset.UnixEpoch;
+
+            PublicScanResult result = repository switch
+            {
+                "missing" => PublicScanResult.Failure(
+                    owner, repository, PublicScanStatus.RepositoryNotFound, "gone", now),
+                "quota" => PublicScanResult.Failure(
+                    owner, repository, PublicScanStatus.QuotaExhausted, "spent", now),
+                "bad" => PublicScanResult.Failure(
+                    owner, repository, PublicScanStatus.InvalidName, "bad name", now),
+                _ => new PublicScanResult(
+                    owner,
+                    repository,
+                    PublicScanStatus.Completed,
+                    Detail: null,
+                    Files:
+                    [
+                        new PublicScanFile(
+                            "ci.yml",
+                            "https://github.test/ci.yml",
+                            new Domain.WorkflowAnalysisResult(
+                                "ci.yml", IsValid: true, [], [], Patch: null))
+                    ],
+                    SkippedFiles: 0,
+                    now,
+                    FromCache: false)
+            };
+
+            return Task.FromResult(result);
+        }
+    }
+}
diff --git a/tests/DevSecOpsSentinel.Infrastructure.Tests/PublicRepositoryScannerTests.cs b/tests/DevSecOpsSentinel.Infrastructure.Tests/PublicRepositoryScannerTests.cs
new file mode 100644
index 0000000..f6a8402
--- /dev/null
+++ b/tests/DevSecOpsSentinel.Infrastructure.Tests/PublicRepositoryScannerTests.cs
@@ -0,0 +1,220 @@
+using System.Net;
+using System.Text;
+using DevSecOpsSentinel.Application;
+using DevSecOpsSentinel.Domain;
+using DevSecOpsSentinel.Infrastructure;
+using DevSecOpsSentinel.Infrastructure.GitHub;
+using DevSecOpsSentinel.Infrastructure.Rules;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace DevSecOpsSentinel.Infrastructure.Tests;
+
+public sealed class PublicRepositoryScannerTests
+{
+    private const string VulnerableWorkflow = """
+        name: CI
+        on:
+          push:
+        jobs:
+          build:
+            runs-on: ubuntu-latest
+            steps:
+              - uses: actions/checkout@v4
+        """;
+
+    [Fact]
+    public async Task Scans_a_repository_and_reports_findings_per_file()
+    {
+        FakeGitHub github = new();
+        github.Listing("octo", "app",
+            File("ci.yml", VulnerableWorkflow.Length, "https://raw.test/ci.yml"));
+        github.Raw("https://raw.test/ci.yml", VulnerableWorkflow);
+
+        PublicScanResult result = await Scanner(github).ScanAsync("octo", "app", CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.Completed, result.Status);
+        PublicScanFile file = Assert.Single(result.Files);
+        Assert.Equal("ci.yml", file.FileName);
+        Assert.Contains(file.Analysis.Findings, finding => finding.RuleId == "GHA001");
+        Assert.False(result.FromCache);
+    }
+
+    [Fact]
+    public async Task Second_scan_of_the_same_repository_is_served_from_cache()
+    {
+        FakeGitHub github = new();
+        github.Listing("octo", "app",
+            File("ci.yml", VulnerableWorkflow.Length, "https://raw.test/ci.yml"));
+        github.Raw("https://raw.test/ci.yml", VulnerableWorkflow);
+
+        IPublicRepositoryScanner scanner = Scanner(github);
+        await scanner.ScanAsync("octo", "app", CancellationToken.None);
+        PublicScanResult second = await scanner.ScanAsync("OCTO", "APP", CancellationToken.None);
+
+        // One metered listing request total — the second scan, even differently
+        // cased, must not spend quota. That is the property the cache exists for.
+        Assert.Equal(1, github.ListingRequests);
+        Assert.True(second.FromCache);
+    }
+
+    [Fact]
+    public async Task Missing_repository_is_not_found_and_the_failure_is_cached()
+    {
+        FakeGitHub github = new() { ListingStatus = HttpStatusCode.NotFound };
+
+        IPublicRepositoryScanner scanner = Scanner(github);
+        PublicScanResult first = await scanner.ScanAsync("octo", "gone", CancellationToken.None);
+        await scanner.ScanAsync("octo", "gone", CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.RepositoryNotFound, first.Status);
+        // A typo retried must not spend the shared quota a second time.
+        Assert.Equal(1, github.ListingRequests);
+    }
+
+    [Fact]
+    public async Task Exhausted_quota_is_reported_as_such_not_as_a_missing_repository()
+    {
+        FakeGitHub github = new()
+        {
+            ListingStatus = HttpStatusCode.Forbidden,
+            RateLimitRemaining = "0"
+        };
+
+        PublicScanResult result = await Scanner(github).ScanAsync("octo", "app", CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.QuotaExhausted, result.Status);
+    }
+
+    [Theory]
+    [InlineData("../etc", "app")]
+    [InlineData("octo", "app/../../secrets")]
+    [InlineData("", "app")]
+    [InlineData("octo", "a b")]
+    public async Task Names_that_are_not_plain_github_names_are_rejected_before_any_request(
+        string owner,
+        string repository)
+    {
+        FakeGitHub github = new();
+
+        PublicScanResult result = await Scanner(github).ScanAsync(owner, repository, CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.InvalidName, result.Status);
+        // The whole point: a hostile name never becomes a URL.
+        Assert.Equal(0, github.ListingRequests);
+    }
+
+    [Fact]
+    public async Task Oversized_files_are_skipped_and_counted_rather_than_fetched()
+    {
+        FakeGitHub github = new();
+        github.Listing("octo", "app",
+            File("huge.yml", PublicRepositoryScanner.MaximumWorkflowCharacters + 1, "https://raw.test/huge.yml"),
+            File("ci.yml", VulnerableWorkflow.Length, "https://raw.test/ci.yml"));
+        github.Raw("https://raw.test/ci.yml", VulnerableWorkflow);
+
+        PublicScanResult result = await Scanner(github).ScanAsync("octo", "app", CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.Completed, result.Status);
+        Assert.Single(result.Files);
+        Assert.Equal(1, result.SkippedFiles);
+        // The oversized file's body was never downloaded.
+        Assert.DoesNotContain("https://raw.test/huge.yml", github.RawRequests);
+    }
+
+    [Fact]
+    public async Task A_repository_with_a_workflows_directory_but_no_yml_files_reports_no_workflows()
+    {
+        FakeGitHub github = new();
+        github.Listing("octo", "app", File("README.md", 10, "https://raw.test/readme"));
+
+        PublicScanResult result = await Scanner(github).ScanAsync("octo", "app", CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.NoWorkflows, result.Status);
+    }
+
+    private static PublicRepositoryScanner Scanner(FakeGitHub github) =>
+        new(
+            github,
+            new WorkflowAnalysisService(
+                new WorkflowParser(),
+                RuleDiscovery.All(),
+                new WorkflowPatchGenerator(
+                    new WorkflowParser(),
+                    RuleDiscovery.All(),
+                    new NeverResolvesActionReferenceResolver(),
+                    new GitHubOptions())),
+            new MemoryCache(new MemoryCacheOptions()),
+            TimeProvider.System,
+            NullLogger<PublicRepositoryScanner>.Instance);
+
+    private sealed class NeverResolvesActionReferenceResolver : IWorkflowActionReferenceResolver
+    {
+        public Task<ActionReferenceResolutionResult> ResolveAsync(
+            string actionReference,
+            CancellationToken cancellationToken) =>
+            Task.FromResult(new ActionReferenceResolutionResult(
+                ActionReferenceResolutionStatus.Failed,
+                null,
+                "Scanner tests do not resolve action references."));
+    }
+
+    private static string File(string name, long size, string downloadUrl) =>
+        $$"""
+        { "name": "{{name}}", "type": "file", "size": {{size}},
+          "html_url": "https://github.test/{{name}}", "download_url": "{{downloadUrl}}" }
+        """;
+
+    /// <summary>
+    /// The GitHub surface the scanner touches, faked at the HttpClient layer so the
+    /// scanner's real request pipeline — URL construction included — is what is tested.
+    /// </summary>
+    private sealed class FakeGitHub : IHttpClientFactory
+    {
+        private readonly Dictionary<string, string> _raw = [];
+        private string _listingBody = "[]";
+
+        public HttpStatusCode ListingStatus { get; set; } = HttpStatusCode.OK;
+        public string? RateLimitRemaining { get; set; }
+        public int ListingRequests { get; private set; }
+        public List<string> RawRequests { get; } = [];
+
+        public void Listing(string owner, string repository, params string[] files) =>
+            _listingBody = "[" + string.Join(",", files) + "]";
+
+        public void Raw(string url, string content) => _raw[url] = content;
+
+        public HttpClient CreateClient(string name) =>
+            new(new Handler(this)) { BaseAddress = new Uri("https://api.github.test") };
+
+        private sealed class Handler(FakeGitHub fake) : HttpMessageHandler
+        {
+            protected override Task<HttpResponseMessage> SendAsync(
+                HttpRequestMessage request,
+                CancellationToken cancellationToken)
+            {
+                string url = request.RequestUri!.ToString();
+
+                if (url.Contains("/contents/.github/workflows"))
+                {
+                    fake.ListingRequests++;
+                    HttpResponseMessage response = new(fake.ListingStatus)
+                    {
+                        Content = new StringContent(fake._listingBody, Encoding.UTF8, "application/json")
+                    };
+                    if (fake.RateLimitRemaining is not null)
+                    {
+                        response.Headers.Add("X-RateLimit-Remaining", fake.RateLimitRemaining);
+                    }
+
+                    return Task.FromResult(response);
+                }
+
+                fake.RawRequests.Add(url);
+                return Task.FromResult(fake._raw.TryGetValue(url, out string? content)
+                    ? new HttpResponseMessage(HttpStatusCode.OK) { Content = new StringContent(content) }
+                    : new HttpResponseMessage(HttpStatusCode.NotFound));
+            }
+        }
+    }
+}