REPOSITORY SECURITY INTELLIGENCE PUBLIC BETA
Know what’s hiding
in your code.
Inspect a GitHub repository for exposed credentials, suspicious code patterns, vulnerable dependencies, and risky automation — with findings you can investigate and fix.
✓ No code execution✓ Evidence-based findings✓ Public repositories
01 / TARGET
Scan a repository
RepoShield reads source files and manifests only. It does not run repository code. Findings are signals for review, not a guarantee that a repository is safe or malicious.
02 / ANALYSIS
Scan report
A clean report is not proof of safety. Static analysis cannot detect every malware family, runtime behaviour, or vulnerability. Review important findings manually.
BUILT FOR DEVELOPERS
Security signals, not scare tactics.
RepoShield is designed to show its work. Each finding includes a reason, location when available, severity, and a practical next step.
Secret exposure
Detect common credential patterns and redact matched values from results.
SECRET SCANNINGSuspicious code
Flag potentially risky download-and-execute patterns and obfuscation indicators.
STATIC ANALYSISDependency risk
Compare supported pinned dependency versions with published vulnerability advisories.
OSV DATABASEWorkflow hardening
Inspect GitHub Actions workflows for risky permissions and unsafe patterns.
CI/CD SECURITYi
Responsible by design
Only scan repositories you are authorized to inspect. RepoShield does not exploit findings, access private repositories without authorization, or execute scanned files. Scan availability may be limited by API quotas and resource caps.