Statically lint a Dockerfile for common security mistakes: untagged/latest base image, missing USER, secrets in ENV/ARG, curl|sh installs, remote ADD. Local files only, zero network.
Lints .env and .env.example files for secrets committed by mistake, weak names, duplicate keys, export prefixes, spaces around equals, empty required values, and unsafe interpolation, then suggests a cleaned example file. Use when a user asks "is this .env safe to commit?", "why won't dotenv load?", or "diff my .env.example". Includes a tested stdlib Python linter.
Statically scan a project directory for leaked credentials (AWS access keys, GitHub PATs, Slack tokens, private-key blocks) before committing. JSON report with masked fingerprints only - raw secret values are never emitted. Zero dependencies, Node 18+.
Lint a single GitHub Actions workflow file for top supply-chain risks: unpinned actions, pull_request_target, secrets echoed in run steps, overly broad permissions. Local file only.
Compare .env against .env.example: missing keys, extra keys, empty values on required-looking vars. Local files only, values never printed.
Compares environment variables across local, staging and production, finds missing, unused or mismatched settings before they break a deploy, and keeps your example env file honest.
Scans repos, CI logs and shared docs for leaked keys and tokens and walks you through rotation.
Checks your servers over SSH on a schedule: disk, memory, failing services, certificate expiry and suspicious logins, then sends a short health report and alerts only when something needs you.
