Black October Scan by Rends

Free

Check a public GitHub repository for the risks behind this month's incidents

Paste a public repository address. In about two minutes you get a report on possible AI and cloud keys in the code, risky AI dependencies (including the poisoned litellm releases), and release workflows that one stolen account could abuse. No sign-up, no GitHub app, no payment.

What the report covers

• Possible AI and cloud keys in the current files (shown masked: provider, first 4 characters, file and line)
• AI packages that are not pinned, moving tags on AI proxy images, and litellm versions published by attackers
• Release workflows: pull_request_target with pull-request code, token permissions, actions not pinned to a commit, release jobs without protection
• What a public scan cannot see, listed plainly

We download the repository once, read it in memory, and keep only the report. We do not keep your code. Reports stay private unless you choose to share a link.

Book a private-repo assessment

Rends runs the deep scan on your private repositories and walks you through the fix list. Book a private-repo assessment.

This scan reads public files only. It can miss things, and it cannot see private settings.