In Development
Repo First Look
A first-look CLI that tells a reviewer where to look before an unfamiliar repository gets any chance to execute: hooks, binaries, symlinks, hidden text, network code, credential surfaces, and history findings.
Who it is for — and why
Maintainers and security-minded builders who need a bounded triage pass before deciding whether an unfamiliar repository is safe enough to inspect more deeply.
Proof you can inspect
- It reads the Git index rather than walking arbitrary filesystem content and inspects only tracked entries
- Sentinel tests prove install hooks and executable fixtures are identified without being invoked
- Symlinks are reported without following them, including explicit refusal of caller-controlled symlink ancestors
- Gitleaks status is reported as clean, findings, skipped, or incomplete — missing tooling is never presented as a clean scan
Limits
- Linux and macOS only at launch
- Gitleaks is optional and may report skipped
- Pattern matches identify review work, not malicious intent