Repo scan

Enter a public GitHub repo. SniffPup reads its current files and lists leaked keys, risky settings and common payment mistakes, each with fix steps and a prompt for Lovable, Cursor, Bolt or Claude Code.

What the quick check looks for

Keys and passwords committed to the repo. Stripe, OpenAI, Anthropic, Supabase service role, AWS, GitHub, database URLs with passwords and more. Values are masked.
.env files committed to git. Only the variable names are shown, never the values.
.gitignore that doesn't cover .env files.
Server-only keys with a browser-visible prefix. Like NEXT_PUBLIC_…SECRET or VITE_…SERVICE_ROLE, which end up in every visitor's JavaScript.
Supabase migrations without row level security. Reads the SQL in supabase/migrations: tables with it off, policies that let anyone read or change rows, and views that skip it.
Stripe payment code. The Payments Doctor quick rules run on the repo's Stripe files.

What the full check adds

Part of the Solo, Starter and Pro plans. See plans.

Known security advisories for your direct npm dependencies (from package-lock.json or exact versions), with the version that fixes each.
The Payments Doctor full rules on your Stripe files.
An AI rules file for Cursor, Claude Code, Lovable or Bolt, so your coding tool is less likely to bring these issues back.

What it can't see

Private repos (not supported yet).
Git history: a key that was committed and later deleted isn't found, but it's still public in the history.
Other branches, unless you give a /tree/<branch> address.
Files over 512 KB, binary files, and folders like node_modules, dist and build.
Settings that live outside the repo: your host's environment variables, the Supabase dashboard and the Stripe Dashboard.
Your live site. For that, run the free SniffPup scan.

Questions

Do you keep my code?

SniffPup downloads the repo's current files from GitHub, checks them in memory on our server for this one response, then drops them. Nothing is stored, logged or used for training. Secret values in results are masked, and .env values are never shown. The full check sends only your direct npm package names and versions to OSV.dev, an open vulnerability database, to look up known advisories.

Can I scan a private repo?

Not yet. Today it reads public repos with no sign-in to GitHub. Private repos would need you to install a read-only GitHub app on just the repos you choose.

Can someone scan my public repo?

Yes, the same as anyone can read it on GitHub. The results show masked keys and variable names only, and SniffPup keeps nothing.

A clean result: am I done?

Not necessarily. It reads the current files only, not git history, other branches or settings in your dashboards. Also run the free scan of your live site.

All Sniff & Fix checks · Payments Doctor · Free security scan of your live app