Surely you would be very comfortable to use this to 'code review' and send all your code, API keys, ENV files and secret urls to a random online service?

I don't think so.

There is a reason why large companies ban the use of unaudited third-party services like this, especially when they aren't compliant with security standards.