GitHub Repo Security Auditor
Last updated:
Security audit of any public GitHub repository via bookmarklet. Scans file tree for exposed secrets (API keys, tokens, passwords), checks package dependencies against known vulnerability patterns, detects misconfigured CI/CD pipelines, and identifies sensitive files that should not be in a public repo.
Drag to your bookmarks bar:
Audit RepoRuns on github.com — requests come from your browser, not MaxIntel's servers.
Install the bookmarklet above, then use it on github.com
GitHub Repository Security Auditor
Public GitHub repositories frequently contain exposed secrets, misconfigured files, and vulnerable dependencies. This tool uses a bookmarklet that runs on github.com to fetch the repository tree and key files via GitHub's API, then scans them for security issues using pattern matching and heuristic analysis.
Secret Detection
The auditor scans file contents for known secret patterns: AWS access keys, GitHub and GitLab tokens, Stripe, Google, OpenAI, Anthropic, Hugging Face, npm, PyPI, SendGrid, Twilio and Mailgun keys, Slack and Discord webhooks, Telegram bot tokens, private keys, database and basic-auth URLs with embedded credentials, JWTs, and generic password/secret assignments (placeholders and env-variable references are ignored). Matches in test, example or fixture paths are downgraded. Each finding links to the file on GitHub and shows a redacted preview.
Dangerous File Detection
Certain files should never appear in a public repository: .env files, SSH private keys, database credentials, keystores, and service account files. The tool checks the entire file tree for these patterns.
- File Tree Scan
- GitHub's Git Trees API returns the entire file structure in one call, enabling comprehensive filename analysis without reading each file individually.
- Content Analysis
- Up to 40 key files (manifests, lockfiles, .env variants, Dockerfiles, docker-compose, GitHub Actions workflows, config files) are fetched and scanned for secrets and misconfigurations — including pull_request_target checkouts, script injection from event data, missing permissions blocks, actions not pinned to a commit SHA, root Dockerfiles, privileged containers and mounted Docker sockets.
🔒 GitHub Repo Security Auditor — FAQ
How do I audit a GitHub repo for leaked secrets?
This tool scans a public repository for exposed API keys, credentials, risky dependencies, and misconfigured files — the GitHub OSINT and security checks attackers run, so you can find issues first.
Does this use my GitHub API quota?
Yes, a little. Requests go from your browser to api.github.com, which allows 60 unauthenticated requests per hour per IP. An audit uses only 2 API requests (repository info and the file tree); file contents are read from raw.githubusercontent.com, which does not count against the API quota. Being logged into GitHub does not raise the limit because the REST API ignores browser session cookies. If the limit is hit, the bookmarklet offers to use a personal access token (kept only in the GitHub tab's sessionStorage), which raises the limit to 5,000 requests per hour.
Can it scan private repos?
Only with a personal access token that has read access to the repository. Being logged into github.com is not enough: the GitHub REST API does not accept browser session cookies, so a private repository returns 404 until you paste a token when the bookmarklet asks for one.
Does it check for CVEs in dependencies?
It inventories dependencies from package.json, requirements.txt, go.mod, Cargo.toml and composer.json, flags unbounded version ranges, unpinned Python requirements and network-fetching install hooks, but it does not cross-reference CVE databases. Use osv.dev, npm audit, pip-audit or Dependabot for that; the tool focuses on exposed secrets, dangerous files and CI/Docker misconfigurations.
Will it detect all secrets?
No secret scanner is 100% comprehensive. The tool uses regex patterns for known key formats. Custom or obfuscated secrets may not be detected. Always pair automated scanning with manual review.
Does it modify anything in the repo?
No. The bookmarklet only performs read operations via the GitHub API. It never pushes, commits, or modifies any repository content.