Security · working demo
Credential audit
A scan across a fictional codebase. Run it with history off and it comes back clean, which is exactly the false comfort most teams are operating under. Turn history on and see what was actually there the whole time.
Scanner output
$ ready, press “Run scan”
Findings
Nothing yet.
The point of this demo: run it once with “include git history” unticked. It reports a clean
working tree, because the working tree is clean, every value comes from an environment
variable, exactly as it should. Then tick it and run again. The credentials were never gone;
they were just no longer in the files you were looking at.
What's real: the scan logic, pattern classes and severity rules mirror a real audit I ran across 25 repositories. What's not: the codebase, keys and repo names are entirely invented. Read the anonymised case study for what the real one found.
What's real: the scan logic, pattern classes and severity rules mirror a real audit I ran across 25 repositories. What's not: the codebase, keys and repo names are entirely invented. Read the anonymised case study for what the real one found.
Has anyone checked yours?
It's usually clean. When it isn't, you want to be the one who finds out.