Check your private code without connecting GitHub. Pick a ZIP of your project and Ember sniffs it with the same checks as the repo scan, right here in your browser.
What it looks for
Keys and passwords in your code, like Stripe, OpenAI, Anthropic, Supabase service role and AWS. Values are masked.
.env files in the ZIP, and a .gitignore that doesn't cover them. Only variable names are shown.
Server-only keys with a browser-visible prefix, like NEXT_PUBLIC_…SECRET.
Supabase migrations without row level security, risky migrations, Stripe code mistakes, and AI routes or admin pages with no server check.
Limits
ZIPs up to 100 MB and 20,000 entries. Up to 6,000 text files are read, each up to 512 KB (lockfiles up to 8 MB).
node_modules, .git, build folders (dist, build, .next and similar), images, fonts and other binary files are skipped.
Because nothing leaves your browser, dependency advisories, registry licence lookups and the package check don't run here. The repo scan runs those.
Git history isn't in a ZIP, so keys that were committed and later deleted aren't found.
ZIP code scan questions
Do you see my code when I use the ZIP scan?
No. Your ZIP is read inside your browser tab and never uploaded. Nothing from your code is sent to SniffPup.
Why doesn't the ZIP scan check my dependencies for known advisories?
Those lookups need our server to ask public databases about your package names and versions. To keep everything in your browser, the ZIP scan skips them. The repo scan runs them.
Can I scan private code without connecting GitHub?
Yes. Zip your project folder and pick it on the ZIP code scan page. The summary (counts and kinds) is free; the full list with fix steps and prompts is part of Solo and up.
