RepoShield scans any Git repository for hardcoded secrets, vulnerable dependencies, OWASP Top 10 issues, and leaks buried in commit history — in minutes, with no configuration.
Each scanner targets a different attack surface. Together they cover the full OWASP Top 10 and more.
30+ compiled regex patterns catch hardcoded API keys, tokens, private keys, and passwords before they ship. Matches are redacted in output — only the first 4 chars are shown.
Queries the open-source OSV vulnerability database for every package in your project. Maps CVSS scores to Critical/High/Medium/Low severity automatically.
Pattern-based detection across 8 languages. Covers the full OWASP Top 10 with 30+ rules including language-specific variants and false-positive suppression.
Walks up to 200 commits to find secrets that were committed and later deleted. Even if the file is gone, the secret lives on in git objects — this scanner finds it.
Sends your most security-relevant files to GPT-4o, Claude Opus, or Gemini 1.5 Pro for context-aware review. Catches logic bugs, IDOR, authorization flaws, and race conditions that patterns miss. Auto-selects the provider from your API key format — no config needed.
No configuration files. No plugins. Paste a URL and scan.
GitHub, GitLab, Bitbucket, or any public git URL. Private repos work too — just ensure the host is reachable. Local paths are also supported.
Secrets, dependencies, static analysis, and git history scanners run in parallel on your machine. Nothing is sent to any external server unless you add an AI key.
Findings ranked by severity. Each includes the file path, line number, code snippet, CWE ID, OWASP category, and a specific fix suggestion. Export as JSON for CI/CD.
Based on CVSS scoring and exploitability — not guesswork.
Run instantly with npx — no install needed. Or use Docker / manual setup.
# Run instantly — no install needed npx reposhield scan https://github.com/owner/repo # With AI deep analysis (optional) npx reposhield scan https://github.com/owner/repo --ai-key sk-... # Start the web UI locally npx reposhield start
# Clone and run git clone https://github.com/ibrahimokdadov/reposhield.git cd reposhield docker-compose up # Or use npx (no Docker needed): npx reposhield start
# Backend (Python 3.9+) cd backend pip install -r requirements.txt python -m uvicorn main:app --port 8000 # Frontend (Node 18+) — in a new terminal cd frontend npm install && npm run dev # Open in browser open http://localhost:5173