Scan a diff or patch for accidentally committed secrets - API keys, tokens, private keys, passwords - in added lines only, values masked. Local text scan, zero network.
Statically scan a project directory for leaked credentials (AWS access keys, GitHub PATs, Slack tokens, private-key blocks) before committing. JSON report with masked fingerprints only - raw secret values are never emitted. Zero dependencies, Node 18+.
Statically lint a Dockerfile for common security mistakes: untagged/latest base image, missing USER, secrets in ENV/ARG, curl|sh installs, remote ADD. Local files only, zero network.
Reads Conventional Commits or a changelog snippet, classifies fix/feat/breaking changes, and recommends the next SemVer bump (patch, minor, or major) with a clear rationale and a preview of the resulting version. Use when a user asks "what version should I ship?", "is this a breaking change?", or "bump SemVer from these commits". Includes a tested stdlib Python advisor.
Audit pasted HTTP response headers for missing security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags. Offline, no fetching.
Finds old and abandoned Git branches in your repositories, checks whether their work was merged or still matters, and asks owners before suggesting a safe cleanup list.
Scans repos, CI logs and shared docs for leaked keys and tokens and walks you through rotation.
