Why repo security matters
Your source code is your most sensitive asset β and the most commonly overlooked attack surface. Developers accidentally commit secrets at an alarming rate:
.env committed to git
Database passwords, API keys, and service tokens exposed to anyone with repo access. Even after deletion, secrets persist in git history.
Hardcoded API keys
Stripe, AWS, GitHub, and Slack tokens embedded directly in source code. Automated scanners find these within minutes of a push.
Missing .gitignore
Without proper ignore rules, IDE configs, build artifacts, and credential files get committed silently over time.
No RLS policies
Supabase projects without Row Level Security let any authenticated user read and write every row in your database.
Unpinned CI actions
GitHub Actions referencing @main instead of a SHA hash are vulnerable to supply chain attacks that silently modify build steps.
Stale repositories
Repos untouched for months accumulate vulnerable dependencies without patches, becoming easy targets for known exploits.
What the scanner checks
The free tier performs 7 surface-level checks against any public GitHub repository:
- Repository metadata β visibility, wiki/pages status, last update timestamp
- .env file detection β walks the full file tree for committed environment files
- .gitignore analysis β fetches and validates against 10 recommended patterns
- Secret pattern matching β samples up to 30 source files for 8 common key formats
- Supabase RLS detection β scans migration files for ENABLE ROW LEVEL SECURITY statements
- CI/CD security β flags GitHub Actions pinned to mutable tags instead of SHAs
- Staleness check β flags repos untouched for over a year
Frequently asked questions
What does the repo security scanner check?
It checks for committed .env files, hardcoded API keys and secrets (Stripe, GitHub, AWS, Slack, Google, JWTs, private keys), missing .gitignore patterns, Supabase Row Level Security policies, unpinned GitHub Actions, and repository staleness.
Is it safe to scan my repository?
Yes. The scanner only reads publicly available data via the GitHub API. It never clones your repo, never stores your code, and never accesses private repositories unless you provide a scoped token in the Pro tier.
What is the difference between free and Pro?
The free tier scans public repos with surface-level checks on a sample of files. Pro adds private repo scanning via your GitHub token, full-file secret detection with entropy analysis, dependency vulnerability audits, CI pipeline hardening checks, and SBOM generation.
Why are committed .env files dangerous?
.env files typically contain database passwords, API keys, and service credentials. When committed to a repository, anyone with read access can extract them. Even if deleted later, they remain in git history and can be recovered by attackers using tools like truffleHog or git-secrets.
Can I scan private repositories?
Not with the free tier. Repo Scanner Pro accepts a scoped GitHub personal access token (read-only) that lets us analyze private repos without ever storing your code or credentials.
How often should I scan my repos?
Every push ideally, but at minimum weekly. Pulse Pro includes automated repo scanning on a schedule so new commits are checked automatically and you're alerted when secrets or misconfigs appear.
Scan private repos, audit dependencies, and harden CI pipelines
Repo Scanner Pro adds private repository support, full-file secret detection with entropy analysis, dependency vulnerability audits against CVE databases, CI/CD pipeline hardening checks, and SBOM generation.
Unlock Repo Scanner Pro β