Repository Security Scanner
Vulnerable dependencies, secrets and risky config - in one scan
Paste a public GitHub repository URL or upload a ZIP of your project. AI Inspector Lab reads manifests and lockfiles across ecosystems, resolves direct and transitive dependencies, matches them against OSV and the GitHub Advisory Database, and scans configuration and source files for hardcoded credentials.
What the inspector checks
Vulnerable dependencies
Exact lockfile versions matched by OSV are reported as affected; declared ranges without a lockfile are reported as potential.
Transitive dependencies
package-lock, yarn.lock, pnpm-lock, poetry.lock, Pipfile.lock, Cargo.lock, Gemfile.lock and composer.lock give the full tree, not just what package.json lists.
Malicious packages
Packages flagged by the OpenSSF malicious-packages feed are reported as critical.
Hardcoded secrets
AWS, GitHub, GitLab, Stripe, Slack, Google, OpenAI, Anthropic, npm and PyPI tokens, private keys, database URLs and high-entropy assignments - values redacted.
Configuration
Dockerfiles running as root or baking in secrets, GitHub Actions script injection and pwn-request patterns, privileged containers, committed .env and key files, debug mode.
Outdated & licenses
Latest versions and licenses of direct dependencies (Pro and Team), from deps.dev.
Who uses it
- Checking a dependency before adopting it
- Pre-release security review
- Open-source maintainers
- Due diligence on acquired code
Repository Security Scanner FAQ
Can you scan private repositories?
Upload a ZIP of the project on Pro or Team. The GitHub integration reads public repositories only.
Do you store my secrets?
No. Only the file, line, a redacted preview and a fingerprint are kept.
Which advisory sources are used?
OSV, which includes the GitHub Advisory Database, PyPA, RustSec, the Go vulnerability database and OpenSSF malicious packages, plus CISA KEV and EPSS for prioritisation.
Other detectors
Try the Repository Security Scanner for free
Check text, public websites and GitHub repositories for free - no account needed. Go Pro for private document, image and code inspections, Compare and the API.