Free Repo Security Scanner
Paste a public GitHub repo and get its leaked secrets (file and line) plus a security posture grade in about a minute. Free, no signup. ShipReady Metrics scans your source for exposed API keys, tokens, and credentials.
Frequently asked questions
- What does the free repo scanner check?
- It downloads a snapshot of a public GitHub repository and scans the source for leaked secrets: AWS keys, GitHub tokens, Stripe live keys, OpenAI and Anthropic keys, Slack tokens, Google API keys, SendGrid keys, Supabase service-role keys, private key material, and hardcoded passwords or API secrets. Every finding is reported with its file and line, and the repo gets a 0-100 security posture score graded A-F.
- Is the scan really free?
- Yes. The summary - grade, score, and the first findings - is free with no signup. The complete file-and-line report unlocks when you leave a work email, which we use to send the report and follow up at most once about continuous monitoring.
- Do you store my code?
- No. The scanner downloads a temporary snapshot, reads it for the scan, and deletes it immediately. Only the findings (rule, file, line, severity) are kept, and only when you opt in with an email.
- Can I scan a private repository?
- The free scanner reads public repos only, and it refuses anything it cannot prove is public. For private repos, ShipReady's GitHub App connects your organization and scans every repo continuously - secrets, end-of-life packages, AI-written code share, and full security posture.
- I found a leaked secret. What now?
- Rotate the credential immediately - treat it as compromised, because public repos are scraped constantly. Then purge it from git history (rotating alone does not remove it from old commits), and add scanning to CI so the next leak is caught at commit time instead of by a scanner like this one.