Statically scan a project directory for leaked credentials (AWS access keys, GitHub PATs, Slack tokens, private-key blocks) before committing. JSON report with masked fingerprints only - raw secret values are never emitted. Zero dependencies, Node 18+.
Scan a diff or patch for accidentally committed secrets - API keys, tokens, private keys, passwords - in added lines only, values masked. Local text scan, zero network.
Statically lint a Dockerfile for common security mistakes: untagged/latest base image, missing USER, secrets in ENV/ARG, curl|sh installs, remote ADD. Local files only, zero network.
Audit pasted HTTP response headers for missing security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags. Offline, no fetching.
Lints .env and .env.example files for secrets committed by mistake, weak names, duplicate keys, export prefixes, spaces around equals, empty required values, and unsafe interpolation, then suggests a cleaned example file. Use when a user asks "is this .env safe to commit?", "why won't dotenv load?", or "diff my .env.example". Includes a tested stdlib Python linter.
Scans repos, CI logs and shared docs for leaked keys and tokens and walks you through rotation.
Scans your project's dependencies for their licenses, flags ones that clash with how you ship your product, and explains each risk in plain words before a release.
