VulnerabilityEnhanced with input11 checks
Source Code SAST Scanner
Scan every file in a connected GitHub repository for live credentials, committed secret files, and high-risk auth, SQL, CORS, SSRF, TLS and cookie patterns.
How this scan works
- Requires a public repo URL, or a token for private repos
- Downloads the repository once as an archive and scans every text file in it — not a sample. There is no file cap
- Detects credentials by their own shape (AWS, GitHub, Stripe, OpenAI, Anthropic, Slack, Supabase service_role and ~50 more issuers), so a key assigned to an innocuously-named variable is still caught
- Where the issuer publishes a read-only identity endpoint, each unique key is checked once against it and reported as live or already revoked
- Scans the repo for committed credential files — .env variants, SSH/TLS private keys, Java keystores, GCP/Firebase service-account JSON, Terraform state, kubeconfig
- Reads .npmrc / .yarnrc / .pypirc / .netrc and flags an inline registry auth token or password (an ${ENV_VAR} reference is fine)
- Pattern-matches source for string-concatenated SQL, Access-Control-Allow-Origin: * in source, fetch/axios calls built from unvalidated user input (SSRF shape), cookies set without Secure/HttpOnly, disabled TLS verification, and eval/shell-exec sinks
- Reports file and line for every match