Why this exists

Every organization above a certain size has the same three questions and no way to answer them: what credentials are sitting in our repositories, what are we shipping that has a known hole in it, and who can reach any of it. The tools that answer those questions well are priced per developer, and at a few hundred developers the number stops being a line item.

The engines that do the actual reading are all free and all excellent. gitleaks, semgrep, syft, grype, trivy and the rest are the same tools the commercial products run underneath their own interfaces. What is missing when you try to use them yourself is everything around them: something that knows what a repository is worth, that can tell an example from a credential, that remembers who decided what, and that puts one list in front of a person in the order they should work through it.

That gap is the whole product.

• Read only, always. It never writes to a repository, never opens a pull request, never revokes a key and never changes anybody's settings. Every credential it asks for is read only and it refuses to ask for more.
• Self hosted, entirely. Your code never leaves your network. There is no cloud component, no telemetry and no license check, so there is nothing to switch off and nothing to trust.
• The cleartext never gets stored. A found credential exists in memory for the length of the scan and becomes a hash and a mask before anything is written down.
• Every judgement shows its reasoning. A verdict with no sentence behind it is an opinion. A person should be able to disagree with the argument, not just the answer.
• Every decision is somebody's. Set aside, regraded, muted: all of them carry a name, a reason and a date, and none of them delete anything.
• Honest about the limits. Every feature page on this site ends with what that feature cannot do, and the comparison page scores the rows that go against us at the same weight as the rest.

Tim Rice, who also wrote Failover LB, which is where this site borrows its shape from. Both are free, both are MIT licensed and both exist because the commercial answer to a real problem cost more than the problem did.

The roadmap is written down and it is a list of things that are missing rather than a list of things that are coming. Items are removed when they are built, not ticked, so what is on it is what is actually left.