repocheck

One command to audit a repo for the three things that most often bite developers before they ship: leaked secrets, .env drift, and unhealthy package.json hygiene.

No dependencies. No network calls. No telemetry. Runs entirely on your machine against your local files.

Install

npm install -g @danny1214/repocheck
repocheck --help

From source (contributing / local dev only)

git clone <this-repo> repocheck
cd repocheck
npm link   # or: node bin/repocheck.js <path>

Usage

repocheck                # audit the current directory
repocheck ./my-project   # audit a specific path
repocheck --json         # machine-readable JSON output
repocheck --history      # also scan full git commit history for secrets

Exit codes: 0 = clean, 1 = issues found, 2 = error running the audit. Designed to be dropped into CI (repocheck || exit 1).

What it checks

1. Leaked secrets

Scans every text file (skipping .git, node_modules, build output) for:

• AWS access/secret keys
• GitHub, Slack, Stripe, Google API tokens
• JWTs
• PEM-format private key blocks
• Hardcoded password assignments
• Database connection strings with embedded credentials
• Any other high-entropy value assigned to a variable that looks like a secret (*_token, *_key, *_secret, etc.)
• Optionally, full git commit history (--history) — catches secrets that were committed and later removed from the working tree but still live in git log.

All matches are redacted in output (AKIA...MNOP) — never printed in full.

2. .env drift

• .env exists but no .env.example/.env.sample template for new contributors
• .env.example exists but there's no local .env to actually run the app
• Keys present in one but not the other (drift between template and reality)
• .env exists but isn't listed in .gitignore (the #1 way secrets get committed by accident)

3. package.json hygiene

• Missing name, version, license, or description
• Scripts that pipe a remote curl straight into a shell (supply-chain risk)
• Dependencies installed directly from a URL instead of a registry version
• Dependencies pinned to * or latest (non-reproducible installs)
• No lockfile present (package-lock.json / yarn.lock / pnpm-lock.yaml)

Why one tool instead of three

Most teams run a secret scanner, a linter, and maybe nothing for .env hygiene — as three separate tools with three separate configs. repocheck is the 80% version of all three in a single dependency-free script, meant to be the thing you actually run before every PR because it takes under a second and needs zero setup.

Testing

npm test

26 tests, all passing, no external test framework required.

License

MIT