visitor@blackz:~/scan — bash — 118×42

// scan any repo // find real issues█

● READY — critical — high — medium secrets: —
initializing...
how this actually works
  1. You pick a real source — paste code directly, upload files from your computer, or type any public GitHub repo (owner/repo or a full URL).
  2. Nothing is pre-written. For a GitHub repo, this page asks GitHub's own public API (api.github.com) for the real file list, then downloads each file's actual text straight from raw.githubusercontent.com — the same bytes anyone sees on github.com. For paste/upload, it reads exactly what you gave it.
  3. The same catalog of … rules is applied to every scan, every time (that number is counted from the loaded catalog at page load, not typed in here) — hardcoded credentials in the exact shapes AWS, GCP, Stripe, Slack, GitHub, OpenAI and other vendors issue, injection sinks, XSS, weak crypto, disabled TLS verification, Terraform/Kubernetes/Docker misconfiguration, and GitHub Actions script injection. Some rules are scoped to the files they can apply to (a Dockerfile rule only runs on Dockerfiles), but no rule is written "about" any specific repo; every rule is generic pattern-matching applied fresh to whatever you just gave it.
  4. Optionally it reads the git history too. A secret that was committed in March and deleted in April is invisible to any scan of the current files — but it is still in the repo, and still valid until someone rotates it. Turn on Scan git history and the page pulls each commit's real diff from api.github.com, scans the lines that commit added, and reports the exact SHA, author, and date so you can verify it yourself.
  5. Every result shows its receipts — the exact file, line number, and matched snippet, so you can go check it yourself in the real source. If a card doesn't show a real file:line, it isn't from a live scan. The network trace panel below prints the literal URL, HTTP status, timing, and the first bytes of GitHub's actual response, so you can watch the data arrive instead of trusting a summary.
  6. Nothing is stored on a server, because there is no server. Your last scan is kept only in localStorage — on your own machine, in this browser — for 24 hours, purely so a refresh doesn't lose your results. It never syncs anywhere, and you can wipe it any time with the Clear cached scan button.
scan a target
Optional: add a GitHub token — raises the API limit from 60/hr to 5,000/hr not set
Kept in a JavaScript variable for this tab only. It is never written to localStorage, never saved with your scan, never printed in the network trace, and never sent to raw.githubusercontent.com — only to api.github.com. Closing the tab erases it. A history scan costs one API request per commit, which is why the 60/hr anonymous limit runs out fast.
Runs entirely in your browser — nothing is uploaded anywhere. Public repos are read via api.github.com (file tree, commit diffs) and raw.githubusercontent.com (file contents), same as any browser could. It reads every file that isn't provably binary — no extension allow-list, so .tf, .vue, Dockerfile and extensionless scripts all get scanned. Anything it does skip (vendored folders, images, files over 1MB) is counted and shown to you, because "clean" is a lie if half the repo went unread. This is a pattern-based heuristic scanner — good for a fast first pass, not a replacement for CodeQL/Semgrep on anything you'd ship.
idle 0.00s
network trace — the literal requests this page made
No requests yet. GitHub scans appear here with the exact URL, HTTP status, timing, and the first bytes of the real response. Paste/upload scans make zero requests — nothing to show, by design.
results at a glance

Severity distribution

Findings by category

detailed issues — click to expand
suggested fix order
legend — new to this? start here
SEVERITY
  • Critical — actively exploitable right now (e.g. a real secret key, an open CORS wildcard). Fix before doing anything else.
  • High — a serious bug or vulnerability (e.g. SQL/shell injection). Fix soon, before shipping.
  • Medium — a real issue, but lower urgency (e.g. debug mode left on).
  • Low / Info — worth knowing, rarely urgent on its own (e.g. weak hash used somewhere non-critical).
CATEGORIES
  • secrets — API keys, tokens, passwords, connection strings, private key files committed to source.
  • injection — user input reaching a shell command, SQL query, template, deserializer, or eval.
  • xss — unescaped content written into the page (cross-site scripting).
  • crypto — weak hashing, broken ciphers, insecure randomness.
  • auth — disabled TLS verification, unverified JWTs, insecure cookies.
  • iac / ci — Terraform, Kubernetes and Docker misconfiguration; GitHub Actions script injection and unpinned actions.
  • config / network / deps / doc — debug flags, open CORS, plaintext HTTP, unverified installs, leftover TODOs.
  • in history — a finding tagged in history came from a past commit's diff, not the current files. It may already be deleted from the repo and still be live in the wild.