RepoSec runs a static, read-only scan against any public GitHub repository and returns a security score, a checks table, and a list of fixes. No installs, no agent, no auth.
What we check
Each check is a static, read-only rule. Every result is reproducible: re-run the scan and the output is identical.
Finds committed .env, .env.local, and .env.production files with real values.
Looks for README, LICENSE, SECURITY.md, .env.example, CHANGELOG, CONTRIBUTING, and CODEOWNERS so new contributors aren't lost.
Verifies that .env, node_modules, and build output are properly ignored.
Heuristically detects OpenAI, GitHub, AWS, Stripe, JWT, private keys, and database URLs. Always masked.
Checks for .github/workflows, Dependabot config, that CI runs on pull_request, runs tests, and does not use permissions: write-all.
Looks for test, lint, audit, and start scripts. Also flags a missing `engines` field and `repository` field.
Detects a missing USER directive, missing HEALTHCHECK, :latest base image, ADD with a URL, and EXPOSE 22.
Checks for issue templates, a PR template, CODEOWNERS, a code of conduct, a changelog, and a contributing guide.
Verifies a description, topics, license on GitHub, the archived flag, and a sensible default branch.
Flags use of eval(), new Function(), and dangerouslySetInnerHTML inside the source tree (skipping node_modules and build output).
Detects a single lockfile, an `engines` field, and a `repository` field. Mixed lockfiles break deterministic installs.
Warns when package-lock.json, yarn.lock, and pnpm-lock.yaml all live in the same repository.
How it works
RepoSec is a Next.js app that talks to the public GitHub API. No auth, no tokens, no agent, no signup.
Type or paste a github.com/owner/repo link. Private repos and bad URLs are caught early.
We pull the public file tree and the files that matter, then run the rule-based scanner.
A security score, per-category check results, severity-grouped findings, and copy-pasteable fixes.
No black-box scoring, no upsells, no paid tiers. Get a markdown report, a JSON report, and a fix prompt for your coding agent in under a minute.
Or paste a URL in the input above.
Scope
RepoSec reads public files only. It is meant to help you find gaps in your own repository, never to help you attack someone else's.