Scan your GitHub & GitLab repos for secrets and code flaws.
The .env you committed at 2am is exactly what attackers grep for. Point Defenso at a repo and it finds the secrets, keys and open buckets, and the risky code and flaws that turn into a breach, before they reach production.
- Committed secrets & keys
- Open storage buckets
- Risky code & flaws
- Vulnerable dependencies
Everything an attacker who cloned your repo would find.
Git history is forever. A key committed once survives every later deletion, lives in every fork, and leaks the day the repo goes public. Your default branch is read the way an attacker would, and every finding comes with a fix that rotates the secret and patches the code.
Tracked .env files, firebase-adminsdk and serviceAccountKey files, API keys, tokens and database URLs matched by pattern, plus S3 and storage endpoints that read as world-accessible. Caught in review, not after the leak.
Beyond secrets, the scan flags hand-built SQL, a service key shipped to the client, debug mode left on and other patterns that turn into a breach. The kind of thing AI-generated code slips in without noticing.
Lockfiles for npm, Composer, pip and more are parsed and checked against the OSV database for known CVEs, with severity and the fixed version in the report. Works with GitHub, GitLab and Bitbucket.
What a repo scan actually looks for.
A repo security scanner is only as good as the things it knows to grep for. Defenso reads your default branch the way an attacker with a clone would, then reports each finding with a fix. It is broader than a single git-secrets pattern list, and it runs online with nothing to install.
Committed secrets and keys
GitHub secret scanning across the tree: tracked .env files, firebase-adminsdk and serviceAccountKey blobs, database URLs, and exposed API keys matched by pattern. A key committed once lives in history forever, so we catch it in review, not after the leak.
Exposed config and open buckets
Config files that ship credentials or point at world-readable S3 and storage endpoints. The kind of open bucket that turns a routine push into a data-leak headline.
Risky code, SAST style
Lightweight SAST over your source: hand-built SQL strings, a service key shipped to the client, debug mode left on, and other patterns that quietly become a breach. The kind of thing AI-generated code slips in without anyone noticing.
Vulnerable dependencies
Lockfiles for npm, Composer, pip and more are parsed and checked against the OSV database for known CVEs, with severity and the fixed version in the report.
Supply-chain checks
Typosquat detection on your dependency names, plus Dockerfile and CI workflow review for leaked tokens and unpinned, over-privileged steps.
A fix with every finding
Each result is ranked by severity and comes with the exact remediation: rotate this key, patch this line, close this bucket. No triage spreadsheet required.
Defenso vs a git-secrets grep.
A local regex pass catches yesterday's known key formats. An online repo security scanner has to do more than that to actually keep committed secrets out of production.
| Capability | git-secrets grep | Defenso |
|---|---|---|
| Committed secret patterns | Basic | ✓ |
| Exposed .env and service-account files | × | ✓ |
| Open storage bucket detection | × | ✓ |
| SAST checks on risky code | × | ✓ |
| OSV CVE checks on dependencies | × | ✓ |
| Typosquat, Dockerfile and CI checks | × | ✓ |
| Scan a public repo by URL, no setup | × | ✓ |
| Fix and severity with every finding | × | ✓ |
| Scheduled re-scans on your branch | × | ✓ |
How the scan runs.
Connect a github.com or gitlab.com repository, or drop in a public repo URL, and Defenso clones the default branch and reads it end to end. Secret patterns, exposed config, open buckets, dependency CVEs and code flaws are checked in one pass, and the report groups every finding by severity with a fix attached. The scanner fails open: a scan that cannot complete never blocks your workflow.
The free tier is real and needs no card. Pro includes 7 repo scans a month and Max includes 20, so you can re-scan on every meaningful change instead of once at launch. Prefer to stay in your editor? The Defenso MCP server exposes a scan_repo tool that scans any public repo straight from Claude, Cursor or Windsurf. Pair it with the website security scanner for what is live, and the managed WAF for what reaches production. See pricing for the full breakdown.
Frequently asked questions.
Everything people ask before they start. Still unsure? We are one message away.
Any repository you connect from github.com or gitlab.com, plus any public repo by URL. Bitbucket is supported for connected repos too. Private repos use a token you can revoke at any time.
Committed secrets and API keys, exposed .env and service-account files, open storage buckets, risky code flagged by SAST-style checks, vulnerable dependencies via OSV CVE data, and typosquat, Dockerfile and CI issues.
git-secrets is a local regex pass for known key formats. Defenso adds exposed-config and open-bucket detection, SAST checks on your code, OSV dependency scanning, supply-chain checks, and a ranked fix with every finding, all online with no setup.
The free tier is real and needs no card. Pro includes 7 repo scans a month and Max includes 20, which is enough to re-scan on every significant change rather than only at launch.
Yes. The Defenso MCP server ships a scan_repo tool that scans any public repository straight from Claude Code, Cursor, Windsurf or VS Code, with the same secret, config and dependency checks.
No. The scanner fails open. If a scan cannot complete it reports the error and never blocks your workflow or your deploy.
Find the secret before an attacker does.
Point Defenso at a repo and get committed secrets, exposed config and code flaws back in seconds. Free, no card, no install.