Free repo scanner

Find local secret risk before your AI agent does.

Run one command to identify expected environment names and tracked local secret-bearing files such as .env, MCP configs, and Claude local settings. 

vibevault scan
vibevault scan --git-only
vibevault guard install
Install CLI View Source

What it checks

The scanner is the first step before vault setup.

You do not need to change your workflow to learn where the risk is. Scan the repo first, then decide what should move into the vault.

Expected secrets

Reads common project files and reports env names the repo expects.

  • .env.example
  • package.json
  • next.config
  • wrangler.toml
  • vercel.json
Tracked local leaks

Flags local secret-bearing files that should not be committed.

  • .env and .env.*
  • .mcp.json
  • .cursor/mcp.json
  • .claude/settings.local.json
Next action

Install the git guard after the first scan so risky files are blocked before commit.

  • Untrack local secret files
  • Add ignore rules
  • Move keys into Vibe Vault
  • Prepare Cursor with MCP

Example

A no-commitment check before agent work.

Scanner output gives developers a concrete reason to protect the repo without starting from security theory.

$vibevault scan
Required (3): CF_API_TOKEN, OPENAI_API_KEY, STRIPE_SECRET_KEY
Missing (2): OPENAI_API_KEY, STRIPE_SECRET_KEY
Git leaks (2): .env, .claude/settings.local.json
>Hint: vibevault guard install

Market context: GitGuardian reported 28.65M new public GitHub secrets in 2025; Lakera found sensitive data in shipped Claude local settings files.