#security

A pluggable linting tool that scans your project for committed credentials like API keys, private keys, and tokens before they hit your repo. Runs as a pre-commit hook or CI check, with built-in rules for AWS, GCP, GitHub, OpenAI, Anthropic, Slack, and more.

An open-source secrets scanner that finds, verifies, and analyzes leaked credentials across Git repos, cloud storage, Docker images, filesystems, and SaaS tools like Postman and Jenkins. Supports over 800 credential types with live API verification, so you know whether a leaked key is actually exploitable and not just a false positive.

An agent skill that audits AI-generated code for common security holes coding assistants introduce, like hardcoded secrets, missing row-level security, and tokens in localStorage. Loads only the checks that fit your stack.