FREE GITHUB SECRET SCANNER

Check a public GitHub repository for exposed secrets.

Pallos reads the public source at one commit, prioritizes security-sensitive files, and reports the file, line, evidence, and a practical fix direction without displaying secret values.

Scan a public repository See how scoring works
Read-onlyNo account requiredSecret values stay hidden
WHAT IT LOOKS FOR

Focused signals with file-level evidence.

  • Credential-like values committed in source code
  • Server-only keys referenced from browser-facing files
  • Environment-variable patterns that may expose private values
  • Placeholder and example credentials separated from stronger signals
WHAT IT CANNOT PROVE

Unknown stays unknown.

  • It cannot prove that a detected credential is active.
  • It does not search private repositories without an authorized GitHub connection.
  • A clean static scan is not a security guarantee or a replacement for secret rotation.
HOW THE FREE SCAN WORKS

Paste. Review. Fix.

  1. 01

    Paste a public GitHub URL

    Use code you own or are authorized to review.

  2. 02

    Read the evidence

    See the affected file, risk, explanation, and practical fix direction.

  3. 03

    Make the change yourself

    Pallos never pushes or edits your repository.

COMMON QUESTIONS

What this check means.

Does Pallos show the secret value?

No. Reports identify the location and risk pattern without printing the detected credential value.

What should I do if a real key is found?

Revoke or rotate it first, remove it from current code and relevant Git history, then move it to server-only secret storage.

Can I scan a private repository?

Yes, after signing in and granting the Pallos GitHub App read-only access to repositories you select.

FREE · PUBLIC REPOSITORIES

Check the code before users find the mistake.

No payment, account, or installation. The repository stays unchanged.

Start the scan