Paste a GitHub URL, get a security report in seconds. Share a badge in your README.
What it scans
| Engine | What it finds | Rules |
|---|
| Betterleaks | Exposed API keys, tokens, webhooks | 150+ patterns |
| OpenGrep | XSS, SQL injection, command injection, insecure patterns | 3,000+ SAST rules |
| Trivy | Known CVEs in dependencies | Real vulnerability database |
| Built-in checks | Hardcoded secrets, missing lockfiles, dangerous functions | 14 regex patterns |
Each repo gets a Vibe Safety Score (0-100) and a letter grade (A-F).
Features
- Instant scanning — paste a URL, get results in seconds
- Auto-scan on visit —
git.exposed/owner/repo triggers a scan automatically
- Fix It For Me — AI generates a PR to fix findings (Pro)
- Continuous monitoring — GitHub webhooks rescan on every push (Pro)
- Commit status checks — pass/fail status on every push (Pro)
- GitHub OAuth — sign in to scan private repos
- SVG badge — embed your score in any README
- Share links —
git.exposed/owner/repo is the report URL
Getting started
Prerequisites
Setup
git clone https://github.com/mimu-sh/git.exposed.git
cd git.exposed
pnpm install
cp .env.example .env
Edit .env with your database URL:
# Required
DATABASE_URL=postgresql://user:pass@host/dbname?sslmode=require
# Optional — scanner backend (without this, built-in regex checks run)
SCANNER_BACKEND_URL=http://localhost:4000
SCAN_SECRET=any-shared-secret
[!TIP]
See .env.example for all available environment variables including GitHub OAuth, billing, and webhook configuration.
Apply database schema
cd apps/web && npx drizzle-kit push
Run the dev server
pnpm turbo dev
Open http://localhost:3000.
Run tests
pnpm turbo test # 87 unit tests
cd apps/web && pnpm test:e2e # 24 e2e tests (Playwright)
Run the scanner backend (optional)
The backend runs Betterleaks, OpenGrep, and Trivy for deep scanning. Without it, the frontend uses built-in regex checks.
cd apps/api
SCAN_SECRET=any-shared-secret PORT=4000 npx tsx src/index.ts
[!NOTE]
The backend requires betterleaks, opengrep, and trivy binaries installed. See the Dockerfile for installation steps.
Architecture
git.exposed/
├── apps/
│ ├── web/ Next.js 16 — frontend, API routes, auth
│ └── api/ Hono — scanner backend, fix worker
├── packages/
│ └── shared/ DB schema, types, scoring, GitHub utils
┌─────────────────────┐ ┌──────────────────────┐
│ Next.js 16 (Vercel)│──────▶│ Hono API (Railway) │
│ - Scan API │ │ - Betterleaks │
│ - Report pages │ │ - OpenGrep │
│ - Auth (OAuth) │ │ - Trivy │
│ - Billing (LS) │ │ - Fix worker │
│ - Webhook handler │ │ - pg-boss queue │
└────────┬────────────┘ └──────────────────────┘
│
┌────▼────┐
│ Neon │
│Postgres │
└─────────┘
Scoring
| Grade | Score | Meaning |
|---|
| A | 90-100 | Clean — ship it |
| B | 80-89 | Minor issues |
| C | 70-79 | Needs attention |
| D | 50-69 | Significant problems |
| F | 0-49 | Do not deploy |
Deductions: critical (-25), high (-15), medium (-8), low (-3), info (0).
Tech stack
Development
| Command | Description |
|---|
pnpm turbo dev | Start all services |
pnpm turbo build | Build all packages |
pnpm turbo test | Run unit tests |
pnpm turbo lint | Lint all packages |
pnpm dev --filter=@repo/web | Frontend only |
pnpm dev --filter=@repo/api | Backend only |
License
MIT
