Scan your repository
Paste a link to a PUBLIC GitHub repository. We'll check it for leaked keys and other secrets left in your code. Free: 5 scans a day (10 if you log in). Nothing is stored.
What we check
Leaked keys and passwords
Secrets accidentally left in your code — before someone else finds them.
A leaked database master key
The Supabase service_role key ignores every access rule you set. If it leaks, anyone who sees it gets full access to all your data.
Passwords and secrets in code
Hardcoded passwords, admin accounts and keys sitting in code that ships to the browser, where any visitor can read them.
Keys deleted but not gone
You removed a key from your code, but GitHub still shows it in old versions. We check those too.
Why a limit? Scans cost us compute. 5 a day covers a check-fix-recheck cycle; logging in doubles it.
This is a pre-launch check that catches the common, dangerous mistakes — not a guarantee of one hundred percent security. No tool replaces a full audit, but most high-profile leaks happen for exactly the reasons we check.
We don't keep your code or keys
Your code is used only during the check and deleted right after. No copies. Any keys we find are masked and never stored — we just show you the spot where you need to remove them.
The scanner engine is open source — check the code yourself: github.com/Nqspq/defcod-engine
What we don't check yet
Today we find secrets in your code — leaked keys, passwords, a committed .env. Three things we do NOT check yet: your database access rules (whether RLS is actually switched on for your tables), the logic of your login (whether it can be bypassed), and vulnerabilities in the libraries your app depends on. These are next. Leave your email and we'll tell you when each one lands. No spam.