Free repository scan: find secrets and vulnerable dependencies

You can search your commit history for specific strings or use a tool to scan your files for common key formats. This tool checks your default branch for secrets that should stay private. If you find a leak, you must revoke the key immediately because deleting the file does not remove it from the history.

You must change every password and secret contained in that file because they are now part of your public history. Remove the file from your repository and add its name to your .gitignore file to prevent it from being uploaded again. You may also need to use a tool like BFG Repo-Cleaner to scrub the file from your past commits.

This tool compares your lock files against the OSV advisory database to find known security flaws. It looks at your npm, Python and Composer requirements to see if any versions are unsafe. You should update your packages to the latest patched versions to keep your application secure.

It is safe if you have removed all secrets, API keys and configuration files containing sensitive data. You should also ensure your code does not contain hardcoded credentials or private server addresses. Run a scan to verify that no hidden risks remain before you change the visibility settings.