Is this repo safe to install?
Scan a public GitHub repo before you trust it.
xlogs checks for malicious install scripts, hidden payloads, credential theft, data exfiltration, poisoned AI instructions, committed secrets and other suspicious code, without ever running the repository.
- 29 security checks
- OSV known-vulnerability lookup on pinned npm dependencies
- Static analysis
- Nothing executed
- Free
- No signup
What it looks for
All 29 checks run on every scan. Every one of them, with what earns its severity and what it refuses to count, is published in the repo scan protocol. These are the ones that matter most:
Code that runs the moment you install it
npm preinstall, install and postinstall scripts, and setup.py build code. These execute on your machine automatically, before you have read a single line.
Encoded blobs that get decoded and executed
A file that decodes an encoded blob and then executes it. That combination is the classic shape of smuggled code, and it is flagged as critical.
Code that reaches for your keys and moves them
Code that reads SSH keys or cloud instance metadata, or that talks to a webhook, paste site, or tunnel commonly used to move stolen data.
Real keys checked into the repository
Real API keys and private keys committed to the repo, with the value masked. Keys inside test fixtures are noted rather than alarmed.
Prompts that hijack your coding assistant
Prompt-injection phrases inside CLAUDE.md, AGENTS.md or .cursorrules, which can hijack an AI assistant you point at the repo.
Pipelines that run strangers' code with your secrets
Workflows that run untrusted pull-request code with your secrets, actions pinned to a movable tag, and Dockerfiles piping remote scripts into a shell.
Packages from outside any registry
Dependencies pulled from git or an archive instead of a registry, third-party package mirrors, and infrastructure opened to 0.0.0.0/0.
Terms that can force you to open your own source
AGPL and SSPL are flagged because they can force you to publish your own source; permissive licenses are confirmed as safe to adopt.
Scan before and after you deploy
- Code
- Scan repo
- Deploy
- Scan app
“Can I trust this code before I run it?” Hostile behaviour in something a stranger wrote.
“What did my deployed app accidentally expose?” Mistakes in something you own.
What this scan doesn't do
Being clear about the limits, because a security tool that oversells its coverage is worse than no tool:
A private repository would mean granting us access to your account, and xlogs does not ask for that.
We read the current snapshot, so a secret deleted in a later commit but still live in history is out of scope here.
This is pattern-based static review, not a full SAST engine. It will not find a subtle logic flaw.
A clean result means these checks found nothing. It does not mean arbitrary code is safe - determined, well-hidden malicious code can still evade pattern matching.
Findings are deliberately calibrated for people who are not security specialists: primitives that legitimate build tools use every day are shown as context, not alarms, and only genuinely high-signal patterns are raised as critical. See the methodology for how we think about that tradeoff.