repoguard-ai
repoguard-ai
RepoGuard AI is a repository security scanning project designed to identify potentially dangerous code patterns and security risks in AI-assisted software development workflows. Its capabilities include detecting exposed API secrets, suspicious prompt-injection patterns, risky GitHub Actions configurations, dangerous scripts, and selected unsafe code patterns. The project also supports configurable scanning rules and machine-readable security reports. Potential applications include developer tooling, secure CI/CD workflows, repository auditing, and AI coding security products. The codebase is available for acquisition by developer-tool companies, cybersecurity teams, and founders interested in extending an existing security scanning solution. Buyers can review the implementation, testing, dependencies, and supported detection rules before agreeing on the transfer scope.
Repository Details
README
RepoGuard AI
RepoGuard AI is a self-hosted B2B repository due-diligence and buyer-readiness scanner.
What it does
Upload a ZIP repository or point the scanner at a local repository. RepoGuard analyzes project structure and produces a buyer-ready audit covering:
- project structure and file inventory
- secrets and credential-like files
- dependency manifests
- tests and test coverage signals
- Docker / deployment readiness
- documentation quality
- API/application indicators
- repository hygiene
- risk findings with severity
- Buyer Readiness Score
- JSON report export
The product is intentionally designed as a standalone codebase: no external SaaS account is required for the core scanner.
Stack
- Python 3.13+
- FastAPI
- Jinja2
- SQLite
- Vanilla JavaScript/CSS
- pytest
Quick start — Windows PowerShell
py -3.13 -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -r requirements.txt
python -m pytest -q
python scripts\seed_demo.py
python -m uvicorn app.main:app --reload
Demo login:
- email: admin@repoguard.local
- password:
Scan API
POST /api/scans with multipart form field file.
GET /api/scans lists previous scans.
GET /api/scans/{id} returns a full report.
GET /api/scans/{id}/report.json downloads the report as JSON.
Commercial positioning
RepoGuard is sold as a working source-code product/codebase, not as a claim of certified cybersecurity compliance. Findings are heuristic and should be reviewed by a qualified engineer before production/security decisions.
License
See LICENSE.txt.