SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsrepo-scrub

repo-scrub

Security & auditing

View repository

Updated 10-15 20:06

About this skill

Repo scrub

Find what shouldn't leave the repository, and fix the safe parts. Catches the problems that most often surface too late: a key committed to .env, no LICENSE, and unclear authorship.

Two passes. Run it on your own repository before publishing or transferring it — it is offline (git + regex, no network). Run it again on any repository you receive, since you can't verify someone else's scrub.

Workflow

  1. Scan first (report only): 
    python3 scripts/scrub_repo.py /path/to/repo
    Reports secrets in tracked files (redacted, with file:line), .env files, git-history leak hits, LICENSE presence, and bot/suspect committers.

  1. Rotate any leaked key first — a human step the tool can't do. Assume anything found is compromised and rotate it at the provider before touching the repository.

  2. Apply the safe fixes:

    python3 scripts/scrub_repo.py /path/to/repo --fix --license MIT --owner "Your Name"

    Untracks .env, adds .env/.env.* to .gitignore, writes a values-blanked .env.example, and scaffolds a LICENSE if missing. Add --redact-code to also replace secrets found in tracked source with REDACTED_SECRET in the working tree (review the diff before committing).

  3. History leaks are reported, never auto-rewritten — that's destructive and needs a force-push. The scan prints the exact git filter-repo command; run it deliberately, after rotating the key.

  4. Authorship — for bot or non-employee committers (CI bots, test@example.com, agent accounts), confirm the code's provenance is what you think it is.

Safety

  • Never commits secrets, never force-pushes, never rewrites history on its own.
  • --fix only untracks/ignores .env, writes .env.example, and adds a LICENSE. --redact-code edits the working tree only — nothing is committed.
  • License scaffolds are stubs (the proprietary one is complete; MIT/Apache are pointers) — confirm the choice yourself; picking a license is not the tool's call.