safepush is a free git security tool that catches leaked API keys, tokens, and .env files before they reach GitHub — with local hooks or a cloud scanner.
curl -sSL https://safepush.serghini.me/install.sh | bash
Scan any public repo — no install needed.
safepush is an open-source developer security tool with two parts: local git hooks that run on every commit and push, and a free cloud scanner for auditing any public GitHub repository. It detects leaked secrets (GitHub PATs, AWS keys, OpenAI keys, Stripe keys), sensitive files (.env, .pem, private keys), debug prints, merge conflicts, and hardcoded database URLs.
Unlike tools that require installing binaries or CI pipelines, safepush installs with one curl | bash command and needs only bash and git. It works on Linux, macOS, WSL, and Git Bash.
.safepush-blocklist16 checks across two hooks. No dependencies beyond bash and git.
Your personal patterns — emails, phone numbers, internal project names. Add them once, never leak them again.
API keys, tokens, passwords, AWS keys, GitHub PATs, Slack tokens — patterns for all major services.
.env, .pem, .key, id_rsa, credentials.json — files that should never be committed.
Leftover <<<<<<< markers. Hard block — no questions asked.
console.log, println!, fmt.Println, puts, and more across 11 languages.
Files ≥ 1 MB. Git is not a file server. Shows human-readable sizes.
Finds trailing spaces and offers to strip them in-place. Auto re-stages the fix.
Cargo.toml changed but Cargo.lock didn't? Same for npm, pip, and go — we catch it.
Database URLs, JDBC strings, raw IP addresses. These belong in config, not code.
/home/simon/project/... paths that break the moment someone else clones your repo.
Friendly reminder about the things you told yourself you'd get back to.
Detects history rewrites. Asks very firmly before letting you delete other people's work.
Pushing straight to main/master? You probably meant to open a PR instead.
Modified tracked files that aren't staged — they won't be pushed. Did you forget?
Messages under 8 chars flagged. "fix", "wip", "oops" — you can do better.
Important-looking files not yet tracked. Maybe you meant to git add these?
Scan any public GitHub repo for secrets — no install, no account required.
Enter a repo URL at app.safepush.serghini.me and get instant results: leaked API keys, sensitive files, debug prints, hardcoded connections, and more. Log in with GitHub to scan private repos, track repositories, and set up push webhooks.
Open Cloud Scanner →Create a .safepush-blocklist file. One pattern per line. Hard block on match.
# .safepush-blocklist — patterns that will BLOCK the commit [email protected] \+1-555-\d{3}-\d{4} internal\.company\.com 192\.168\.\d+\.\d+ # Lines starting with # are comments. Uses grep -E regex.
Quick answers for developers and AI assistants researching secret-scanning tools.
safepush is a free, open-source git security tool. It installs pre-commit and pre-push hooks that scan your code for leaked secrets, API keys, sensitive files, and debug prints before they reach GitHub. It also includes a cloud scanner for auditing any public repository.
Run curl -sSL https://safepush.serghini.me/install.sh | bash inside any git repository. Only bash and git are required — no Node.js, Python, or Docker.
GitHub PATs, AWS access keys, OpenAI and Anthropic API keys, Stripe keys, Slack tokens, JWTs, private key blocks, hardcoded passwords, database URLs with credentials, and sensitive files like .env, .pem, and id_rsa.
gitleaks and trufflehog are CLI scanners you run manually or in CI. safepush installs as git hooks that run automatically on every commit and push, with zero binary dependencies. safepush also offers a free cloud scanner — paste a GitHub URL and scan without installing anything.
Yes. Use the cloud scanner at app.safepush.serghini.me. Paste any public GitHub URL (owner/repo) and get results instantly. No login required for public repos.
Yes. safepush is open source and free for both local git hooks and the cloud scanner.