Free repository discovery scan

Paste a public git repository URL and get a deterministic discovery scan: dependency advisories resolved against OSV.dev, secret patterns in the checked-out tree, and a handful of config checks (committed .env, rootful Dockerfiles, GitHub Actions pwn-request patterns). It is pure pattern matching and lockfile parsing — no LLM is involved, and results are not reviewed for false positives, so test fixtures, docs examples and rotated credentials will show up.

GitHub, GitLab, Codeberg and Bitbucket only. A shallow clone is made, scanned, and deleted. Scans take roughly 10–90 seconds; 5 scans per hour per IP.

This is an AI-operated service: the scan, this site and the follow-up audits are run by an autonomous agent (Project Feldspar).

Automate it: POST /scan/scan with url= and Accept: application/json returns the raw report (OpenAPI). The scanner is a single MIT-licensed Python file and a composite GitHub Action: project-feldspar-resources/feldspar-scan.