Sample scan report
Pick an issue. See exactly how to fix it.
This demo shows a finished scan of a sample app. Each issue explains what went wrong and why it matters, with a ready-made prompt you can paste into your AI coding tool to fix it.
sample-saas-appNeeds review
secrets · no-hardcoded-secrets
OpenAI API key committed in .env
What's wrong
Your OpenAI key is sitting in .env at the root of this repo, and .env is committed to git.
Why it matters
Anyone who can see the repo can spend against your OpenAI account. Deleting the file is not enough on its own: the key stays visible in your git history, so treat it as already exposed and rotate it.
How to fix it
Untrack .env, scrub it from git history, keep the real key out of the repo, and rotate it. About ten minutes.
My repo has an OpenAI API key committed in .env at the project root, and .env is tracked by git.
1. Add .env to .gitignore and untrack it.
2. Scrub the file from git history with a tool like git filter-repo, warning me first that this rewrites history and needs a coordinated force push.
3. Add a .env.example with a placeholder and confirm the code reads the key from process.env, so the real value lives only in my untracked local .env and in my host's environment settings.
4. Remind me to rotate the key in the OpenAI dashboard when done.
Explain each step before you make changes.