GitHub
Code quality
Security & compliance
Secret hygiene
Credentials committed to the source tree.
Overview
A scan of the repository tree for live credentials: provider API tokens, private keys and certificates, and .env files that were committed and never removed. Findings record the location and the credential type, never the value.
What it looks for
- Hardcoded provider API tokens and access keys
- Committed .env files
- Private keys and certificates in the source tree
- Environment files missing from .gitignore
Why it matters
A committed key is compromised from the moment it lands, and staying in git history means removing the file does not undo it. Provider tokens found this way are usually long-lived and broadly scoped.
Rules in this check
| What it reports | Fix path |
|---|---|
| Hardcoded provider API token | Guide |
| Committed .env file | Guide |
| Committed private key or certificate | Guide |
| Missing .gitignore coverage for env files | Pull request |
How the fixes arrive
Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.