Free GitHub secret scanner for public repositories

What it reads

• Public repositories only. The check downloads the archive GitHub serves to anyone for the default branch, so it needs no GitHub sign-in and uses no GitHub API quota. Paste the repository's home URL, such as https://github.com/owner/project, without a branch or file path.
• Every text file in every folder of that snapshot, including dotfolders, examples, vendor and build output, and lockfiles. Binary files, symbolic links, Git LFS pointers and files larger than 10 MiB are skipped, and each skipped file is listed in the report with the reason.
• Lockfiles for the dependency check: package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, Cargo.lock, poetry.lock, go.mod, composer.lock, Gemfile.lock, and requirements*.txt lines pinned with ==. Only package names and versions are sent to OSV.dev; no source code, paths or findings leave the scan.

What you get back

• Possible credentials first, grouped when the same value repeats, with the likely service, the file and line (linked to that line on GitHub) and why it was flagged.
• Values masked. On the web they are never sent to your browser at all, so a report is safe to copy, download or share.
• Rotation guidance for each finding, and a coverage list of every file that was skipped.
• Dependencies with known advisories, their severity and the fixed version where OSV lists one.
• Values in test, fixture, mock, sample and example files are counted, not listed. A real-looking key in a test file is still listed. This separation relies on paths and value patterns, so it can be wrong in both directions.

Limits, in numbers

What it does not do

• It does not check private repositories, other branches or tags, Git history, commit messages, submodules or Git LFS objects on the web.
• It does not test any key against its provider, so it cannot tell you whether a key still works. Treat a real match as live until you have rotated it.
• It is not a code vulnerability audit. It looks for exposed secrets and personal data, and for published advisories on pinned dependencies; it does not analyse your own code for bugs.
• The dependency check only sees exact versions in the files listed above. A manifest without a lockfile, or a version range, cannot be matched to an advisory, and OSV only knows advisories that have been published.
• A clean result means the enabled checks found nothing in the files that were read. Detection can miss items or flag harmless text, and no check can prove that a repository holds no secret.

If you own the repository

Turn on GitHub's own tools as well. For public repositories, GitHub's secret scanning runs automatically for free and scans the entire Git history on all branches; its alerts appear in the repository's security tab, and partner secrets are reported to the provider that issued them. Source: About secret scanning (GitHub Docs).

Redaxa's web check is a different kind of look: anyone can run it on any public repository, without access to its settings, and it puts masked credentials, coverage and vulnerable dependencies in one report you can share. For the history of a public repository, the Redaxa Windows app runs a deeper review on your own PC with Pro or Business, including past commits, other branches and supported archives.

When a finding is real

Rotate the key with the provider first; deleting the line in a new commit does not help, because the value stays in the history and in any forks or clones. The step-by-step guide covers rotation, moving the new value out of the code and when rewriting history is worth it: how to check a public GitHub repo for leaked API keys. The detection reference lists every key and token format Redaxa recognises, with real engine output.