Committed secrets
Detect high-signal credential patterns such as private keys, GitHub tokens, AWS credentials and hardcoded secrets.
Repository intelligence for JavaScript and Node.js projects
Know what is hiding inside your repository.
GSkout turns a GitHub repository into a readable technical risk report covering source security, vulnerable dependencies, committed secrets, configuration, repository files and overall health.
Public repositories work by URL. Sign in with GitHub for repositories available through your GSkout GitHub integration.
acme/platform
Analysis complete
Repository health
82/ 100
2
High risk
4
Vulnerable deps
96%
Coverage
Priority signals
Hardcoded secret detected
src/lib/provider.js · line 18
Untrusted input reaches exec()
src/api/deploy.js · line 42
Dependency security update
postcss · 5 advisories
Repository intelligence
Built to explain risk, not just count warnings.
GSkout combines focused analyzers into one report so you can understand what was found, where it lives, how serious it is and what to investigate next.
Explore analyzersDangerous code paths
AST-aware analysis detects dangerous execution primitives and adds stronger findings when request-controlled data reaches them.
Dependency vulnerabilities
Evaluate installed dependency versions against vulnerability advisories, deprecations and available updates.
Configuration risks
Inspect selected Node.js, Next.js, Docker, Vercel and GitHub Actions configuration for high-signal problems.
Source security
Dangerous API use is not always the same as an exploitable flow.
GSkout uses AST-aware analysis and lightweight framework context to distinguish a dangerous primitive from stronger evidence that request-controlled data reaches a sensitive sink.
That distinction helps reduce noise and raises severity when the repository contains a clearer path to command injection or dangerous dynamic execution.
Confirmed data flow
req.body.address
↓
string concatenation
↓
child_process.exec()
CriticalHigh confidence
Dependency vulnerabilities with context.
GSkout combines installed package versions with registry metadata and OSV advisory information. Vulnerability findings can link to external resources such as NVD, GitHub Security Advisories, upstream advisories and package pages.
mathjs
3.16.1
3 advisories
express
4.18.3
No known issue
legacy-package
Unresolved
Not evaluated
Repository health
One score, with the reasons behind it.
Repository health combines security signals, dependency condition, analysis coverage and analysis quality. The report exposes the components instead of hiding the score behind a black box.
How repository health works01
Choose a repository
Paste a public GitHub URL, or authenticate with GitHub and select a repository available through the installed integration.
02
GSkout analyzes it
GSkout loads repository metadata, dependency information, selected source files, configuration and repository structure.
03
Investigate the report
Review findings, inspect affected files and dependencies, follow advisory resources and move between multiple repository reports.
Designed around JavaScript and Node.js repositories.
GSkout V1 is deliberately focused. It does not claim to be a universal language scanner or complete SAST platform.
JavaScript and Node.js repositories
Public GitHub repository URLs
Private repositories through GitHub integration
Dependency vulnerability intelligence
AST-aware source analysis
Committed secret detection
File-level findings
Repository health scoring
Frequently asked questions
What repositories can GSkout analyze?
GSkout V1 focuses on JavaScript and Node.js repositories that contain a package.json. Public GitHub repositories can be analyzed by URL.
Can GSkout analyze private repositories?
Yes, when the repository is available through the configured GitHub App installation.
Is GSkout a full SAST replacement?
No. GSkout combines focused repository intelligence, dependency analysis, secret detection, AST-aware checks and lightweight source-to-sink context. It does not claim full program-wide static analysis.
Does a high repository health score guarantee the repository is secure?
No. Repository health summarizes the signals GSkout can evaluate. A repository can still contain issues outside GSkout's supported analysis scope.
Move from “I think this repository is fine” to a report you can inspect.
Analyze the repository and see security, dependencies, configuration, files and health in one place.
Open workspace