Leaked secrets
Gitleaks looks for API keys, tokens and passwords committed to the project.
Code Scan
Find basic security oversights before you ship.
A free command-line tool that scans your project locally for leaked secrets, risky code patterns and vulnerable dependencies before it goes to production. It works well with coding agents such as Claude Code.
01What it checks
Four kinds of basic oversight.
The scanner orchestrates established open-source engines and adds its own rules. It is free.
Risky code patterns
Semgrep runs with local rules to flag common unsafe patterns.
Vulnerable dependencies
OSV-Scanner checks your dependencies against an offline vulnerability database.
Its own YAML rules
Extra rules cover basics such as Docker images pinned to latest and unpinned dependencies.
02Install
Install it today, run it locally.
Nothing is sent anywhere during a scan, and secrets are always masked in the output. Requires Node.js 22.12 or later.
$ npm install -g https://github.com/Sami-BUTRT/dotation-cli/releases/latest/download/dotation.tgz
$ dotation scan
The tool is still distributed under its previous name, dotation, and was previously published at dotation.app. It will become available as speculynx code from the Speculynx CLI. Source: github.com/Sami-BUTRT/dotation-cli.
Static-analysis boundary
A clean scan is not proof of security.
A static local scan surfaces signals; it does not prove a project is secure.
Read the technical trust model →