Repo scan
Enter a public GitHub repo. SniffPup reads its current files and lists leaked keys, risky settings and common payment mistakes, each with fix steps and a prompt for Lovable, Cursor, Bolt or Claude Code.
What the quick check looks for
- Keys and passwords committed to the repo. Stripe, OpenAI, Anthropic, Supabase service role, AWS, GitHub, database URLs with passwords and more. Values are masked.
- .env files committed to git. Only the variable names are shown, never the values.
- .gitignore that doesn't cover .env files.
- Server-only keys with a browser-visible prefix. Like NEXT_PUBLIC_…SECRET or VITE_…SERVICE_ROLE, which end up in every visitor's JavaScript.
- Supabase migrations without row level security. Reads the SQL in supabase/migrations: tables with it off, policies that let anyone read or change rows, and views that skip it.
- Stripe payment code. The Payments Doctor quick rules run on the repo's Stripe files.
- AI routes anyone can use on your bill, and AI called straight from the browser. Routes, server actions and functions that call OpenAI, Anthropic, Gemini, OpenRouter and others with no sign-in check and no rate limit, plus a spend-limit checklist for each provider we find.
- Admin pages that are only hidden in the browser. Admin pages and routes with no check on the server, and admin roles read from values users can change.
- Packages that don't exist, known malware and lookalike names. AI coding tools sometimes add packages that don't exist, and attackers register those names with harmful code in them. We check package.json, requirements.txt, pyproject.toml and Pipfile against the public npm and PyPI registries and OSV's malicious-packages records, and give you a corrected file with any known malware taken out. You can also paste a single file.
- Licences of your npm packages, with an SBOM you can download.
What the full check adds
Part of Solo and up. See plans.
- Known security advisories for your direct npm dependencies (from your lockfile or exact versions), with the version that fixes each.
- The Payments Doctor full rules on your Stripe files.
- Login and sign-up limits, bot checks, AI output caps, the AI model chosen by the request, and unsafe use of AI replies.
- Licences looked up in the npm registry when the lockfile doesn't list them, and advisories included in the SBOM.
- Brand-new, unproven packages (under 30 days old, barely downloaded, no source link) flagged for a closer look.
- A corrected package file with every package fix in it (made-up names, lookalikes and empty names too, not only known malware).
- An AI rules file for Cursor, Claude Code, Lovable or Bolt, so your coding tool is less likely to bring these issues back.
What it can't see
- Private repos you haven't connected. On Solo and up, connect GitHub and choose the repos it can read.
- Git history: a key that was committed and later deleted isn't found, but it's still public in the history.
- Other branches, unless you give a /tree/<branch> address.
- Files over 512 KB, binary files, and folders like node_modules, dist and build.
- Settings that live outside the repo: your host's environment variables, the Supabase dashboard and the Stripe Dashboard.
- Your live site. For that, run the free SniffPup scan.
Questions
Do you keep my code?
SniffPup downloads the repo's current files from GitHub, checks them in memory on our server for this one response, then drops them. Nothing is stored, logged or used for training. Secret values in results are masked, and .env values are never shown. The full check sends only your direct npm package names and versions to OSV.dev, an open vulnerability database, to look up known advisories. Licences come from the repo's own lockfile. If the lockfile doesn't list them, the full check looks up the package names and versions (nothing else) in the public npm registry (registry.npmjs.org). To check your packages, SniffPup sends only package names (and exact versions, if you pin them) to the public npm and PyPI registries and to OSV.dev. Your file is checked in memory for this one response and never stored, logged or used for training.
Can I scan a private repo?
Yes, on Solo and up. Connect GitHub and pick only the repos you want checked. Access is read-only, and your code is checked in memory and never stored or used for training.
Can SniffPup check every push?
Yes, on Solo and up. Connect GitHub, pick a repo and turn on “Check on every push”. We check each push to your default branch and email you only when something serious is new.
Can SniffPup check pull requests?
Yes, on Solo and up. Turn on “Check pull requests” for a connected repo and each pull request gets a SniffPup check on GitHub showing only the issues it adds.
Can SniffPup fix issues for me?
For some, yes. On Solo and up, findings like a committed .env file get an “Open a fix PR” button. SniffPup opens a pull request with the change, and nothing changes until you merge it.
Can someone scan my public repo?
Yes, the same as anyone can read it on GitHub. The results show masked keys and variable names only, and SniffPup keeps nothing.
Does the repo scan contact my site?
The repo scan never contacts your site.
A clean result: am I done?
Not necessarily. It reads the current files only, not git history, other branches or settings in your dashboards. Also run the free scan of your live site.
The package check's lists of well-known packages come from npm-high-impact by Titus Wormer (MIT) and top-pypi-packages by Hugo van Kemenade (CC BY 4.0). Malware records come from OSV.dev and the OpenSSF malicious-packages project.
All Sniff & Fix checks · Payments Doctor · Free security scan of your live app