#security

A pluggable linting tool that scans your project for committed credentials like API keys, private keys, and tokens before they hit your repo. Runs as a pre-commit hook or CI check, with built-in rules for AWS, GCP, GitHub, OpenAI, Anthropic, Slack, and more.

An open-source secrets scanner that finds, verifies, and analyzes leaked credentials across Git repos, cloud storage, Docker images, filesystems, and SaaS tools like Postman and Jenkins. Supports over 800 credential types with live API verification, so you know whether a leaked key is actually exploitable and not just a false positive.

An agent skill that audits AI-generated code for common security vulnerabilities that coding assistants tend to introduce, like hardcoded secrets, missing row-level security, client-submitted prices, and tokens in localStorage. Built for Claude Code and other Agent Skills-compatible tools, it loads only the checks relevant to your stack (Supabase, Stripe, React Native, etc.) so you're not wasting context on irrelevant rules.