RepoChecker | Security Tool by Husain Hakim

Project Overview & Threat Context

RepoChecker is a local-only, read-only CLI tool designed to catch accidentally committed secrets, sensitive files, broken .gitignore rules, and untracked work before pushing to GitHub.

Problem Statement & Objective

Developers frequently push repositories containing accidentally committed secrets, sensitive files, or broken .gitignore rules. These mistakes are easy to make and embarrassing or costly to fix after the fact. RepoChecker catches these realistic, high-impact mistakes locally before they reach a remote repository.

Security Concepts & Principles

• Secret Detection
• Git Forensics
• Repository Hygiene
• Local-only Processing

Technologies & Tools

• Python 3.10+
• CLI
• Regex

Technical Architecture & Mechanics

• Local-only: Never makes network requests. No telemetry, no cloud, no GitHub API.
• Read-only: Never modifies files or git state. Only reads and reports.
• Git tracking awareness: Distinguishes between files that exist, are ignored, and are tracked.
• Deterministic matching: Uses conservative pattern matching and git's own index data without AI or cloud inference.

Key Capabilities & Features

• Detects hardcoded API keys, passwords, and private key material.
• Flags sensitive files like .env or credentials.json that are tracked by Git.
• Identifies files that exist but lack a .gitignore rule.
• Recognises conventional test directories and patterns.

# Check the current directory
$ repochecker

# Check a specific project
$ repochecker ./my-project

Lessons Learned

• Gained experience parsing git index and working tree state.
• Implemented conservative regex patterns for secret detection to minimize false positives.
• Designed a secure, local-only CLI tool that never exposes raw secret values.

Future Roadmap

• Integrate RepoChecker as a Git hook (pre-push or pre-commit).
• Actively prevent committing or pushing code with critical issues without explicit override.