Secret scanning for GitHub repos

Leaked keys don't wait. Neither should your scan.

Paste a repository URL and get every exposed API key, credential, and private key in seconds. No signup. Your code is never stored.

20+ detection rules · avg scan < 5s · code deleted after every scan

minimalsecops — scan
$ ready. 3 free scans per day, no account needed.

How it works

One request in, one report out. Built for solo developers and small teams who don't have time for enterprise security theater.

Clone

Shallow clone, in memory

We pull only the latest snapshot of your repo into an isolated temp directory. Private repos supported on Pro with a scoped token.

Scan

20+ high-signal rules

AWS, GitHub, Stripe, Slack, OpenAI keys, private keys, database URLs and more — with false-positive filtering so you're not chasing placeholders.

Delete

Report, then gone

You get findings with file, line, and severity. The clone is deleted immediately. Nothing about your code is retained.

Pricing

Start free. Upgrade when you need private repos or CI-scale usage. Cancel anytime.

Free

$0

  • 3 scans per day
  • Public repositories
  • Full findings report
  • No account required
Scan a repo now

Pro

$9 /month

  • 200 scans per day
  • Private repositories
  • API access for CI pipelines
  • License key issued instantly
Subscribe to Pro

Built to be trusted with your code

A security tool has to hold itself to a higher bar. Here is exactly how we handle your data.

✓Code is never stored. Repos are cloned to a temp directory and deleted after every scan, success or failure.
✓Secrets are masked. Reports show only the first and last characters of a match — never the full value.
✓Tokens are single-use. A GitHub token you provide is used once for cloning and never written to disk or logs.
✓Keys stored as hashes. Your license key is kept only as a SHA-256 hash on our side.
✓Payments by Lemon Squeezy. Billing, cards, and tax are handled by our merchant of record — we never see your card.
✓Independent and small. Built in the open by an indie developer. Questions? Email us — a human answers.

FAQ

Do you keep a copy of my repository?

No. The repo is shallow-cloned into an isolated temporary directory, scanned, and deleted immediately — even if the scan fails. We store only the findings metadata you see in the report.

How do private repositories work?

On Pro, pass a fine-grained GitHub token with read-only access to the repo. It's used once for the clone and never persisted. We recommend a token scoped to a single repository with a short expiry.

What happens after I subscribe?

Checkout is handled by Lemon Squeezy. You receive a license key by email instantly — that key is your API key. Use it in the X-API-Key header or paste it here on the site.

Can I use this in CI?

Yes. Pro includes API access — call POST /v1/scan from any pipeline and fail the build if criticals are found. Docs are available at api.minimalsecops.com/docs.

What if I find a security issue in MinimalSecOps itself?

Please email security@minimalsecops.com. We read every report and credit responsible disclosure.