Pre-commit secret scanner
Stop leaked keys before they leave your laptop.
xoras-sentry checks every commit for API keys, tokens and private credentials, and stops the commit before it's too late.
$ git commit -m "ship it"
✖ src/lib/pay.ts:14 Stripe live key hardcoded
✖ app/api/route.ts:8 process.env[name] exposed to client
Commit blocked. 2 secrets kept off GitHub.
Reads code, not just text
Parses every file into a syntax tree, so it flags real secrets and ignores look-alikes that trip up pattern matchers.
Catches hidden env access
Traces dynamic process.env lookups and server secrets leaking into client bundles in Next.js 15.
Blocks it before commit
Runs as a git pre-commit hook and a GitHub check. A leaked key never reaches your history.
Fully local
No upload, no cloud scan. Your source code stays on your machine.
Free download
Free forever. No account needed.
The scanner runs on your own machine. Nothing to sign up for, and your code is never uploaded.
View source on GitHub1. Download the scanner
$ git clone https://github.com/aoxendine3/xoras-sentry.git2. Install it
$ cd xoras-sentry && npm install3. Scan your project
$ node packages/cli/bin/cli.cjs /path/to/your-projectTalk to us
Want Team or an Enterprise pilot?
Tell us a little about your team and we'll get back to you.
Need it for private projects or a whole team?
Pro from $12 per developer a month. Team from $29.