SECURE//REPO

Repository security auditor with a command-line console and a neural-map GUI.

Static code analysis · secret detection · library & supply-chain intelligence · repository structure mapping · optional compliance evidence (OWASP, PCI DSS, ISO 27001, SOC 2, GDPR, HIPAA, NIST SSDF)

Español · Documentation · Changelog

What it does

Point it at a Git repository (the one you are in, a local path or a Git URL, including private ones) and it audits it read-only: it never runs the audited code and never installs its dependencies.

Quick start

git clone https://github.com/Wissen01720/Secure_Repo.git
cd Secure_Repo
./run.sh scan /path/to/repo        # Windows: .\run.bat scan C:\path\to\repo
./run.sh gui                       # the graphical interface

The launcher creates a private virtual environment on the first run. Inside a Git repository, ./run.sh alone opens the interactive console. Python 3.10 or newer and Git are required. More options (pipx, from source, updating): Installation.

secure-repo scan . --yes --plain --no-menu --baseline baseline.json --fail-on high     # a CI gate for new problems only

How accurate is it?

Measured on code the authors did not write: four public projects pinned to a commit (NodeGoat, DVPWA, Vulnerable-Flask-App and the clean library requests), every finding reviewed by hand.

Small sample, so read it as a floor of evidence and not as a guarantee: the details, the misses and how to reproduce it are in How the analysis works. The limits of a static analyzer (what it cannot see) are in Privacy, trust model and limitations.

Documentation

Rules of engagement

Only audit repositories you own or have explicit, written permission to assess.

Secure Repo is built for defenders and enforces that posture:

• It never executes the audited code, never installs its dependencies and never exploits a finding.
• It asks you to confirm your authorization before every engagement (--yes confirms it in automation).
• Detected secrets are redacted in the terminal, the GUI and every report.
• Git runs hardened: hooks disabled, ext:: transport blocked, shallow clones, LFS downloads skipped.

Using the tool to steal information or for any malicious purpose is forbidden by the license.

License

Copyright © 2026 Wissen01720. All rights reserved.

Secure Repo is distributed under the Secure Repo Ethical Source-Available License: you may use it, study it and use its reports (also inside your company) for lawful, authorized security work. You may not use it to access code without permission, steal or misuse the information it finds, attack systems, remove the attribution, claim authorship, sell it or publish modified versions without permission. Read the full LICENSE. It is source-available, not open source: if your organization requires an OSI-approved license, contact the author.