Security Hub
Scan for hard-coded secrets, risky containers, dependencies and live endpoints.
- Run DevSnip Pro: Security Hub (or a single scan command from the table below).
- Pick a scan and start it. Workspace scans read your files locally and skip dependency, build and cache folders.
- Open a finding to see its file and line, evidence (secrets are masked), severity and fix.
- Export the results as Markdown or JSON to share them or attach them to a pull request.
| Scan | What it checks |
|---|---|
| Workspace Security Audit | Hard-coded API keys, tokens and passwords, injection risks, weak cryptography |
| Cloud & Container Audit | Terraform, Kubernetes, Docker Compose, Dockerfiles and GitHub Actions |
| Dependency & Config Check | Lockfiles, unbounded ranges, compromised packages, registry credentials, . hygiene |
| Endpoint Security Scan | TLS, HSTS, security headers, CSP, CORS, cookies, auth behaviour and rate limiting |
Heads upOnly scan endpoints you are authorised to test. Its two active checks (a reflected-input probe and well-known sensitive paths) are off by default; enable them per scan or with devsnip..
TipFound a real secret? Rotate it — removing it from the code does not remove it from git history.