Safe Repository Check

Context

Security audit for sensitive data in repository. Check for credentials, API keys, company-specific information, and PII.

Modes

• Default (full-scan): scans all git-tracked files plus history. Use for periodic audits or first-time repo review.
• --diff [<base>]: scans only what changed: the branch's commits since <base>, plus staged + unstaged changes. No <base> → staged + unstaged only. Use before a commit, from review, or from to-pr --safe. Fast, no false positives from pre-existing files.

Workflow

Default (full-scan)