Does Reposcope copy whole repositories?

No. It searches the platforms' own search indexes and keeps only the findings, deduplicated by platform, repository, path and content, so the same file seen twice is one record.

Does it tell me whether a key still works?

No, and deliberately. A match is checked for the right shape, and nothing is ever tried against the service the key belongs to. Treat a critical finding as live until you have rotated it.

How do I see only what is new since I last looked?

Every finding carries a sequence number. Pass the last one you saw as since_seq and you get every finding of yours inserted or updated after it, without re-reading the rest.

Which platforms are covered?

GitHub, Codeberg and Gitea, GitLab and Hugging Face. GitLab is searched for repositories, users and issues rather than code, and Hugging Face for models, datasets and spaces, which carry no per-file history and so no exposure date.

MODULE 09 · Code Exposure IntelligenceEarly access

Which of your secrets is sitting in a public repository, and since when?

Reposcope searches the code-hosting platforms live for a domain, a key prefix or an internal name: GitHub, Codeberg and Gitea, GitLab and Hugging Face. It keeps no mirror of anyone's code, only the findings: every file it turns up is read for secrets and leftover artifacts, dated by the commit that introduced it where the platform keeps one, and graded the way an analyst grades a source.

Start free evaluation Ask for a Proof of Concept

01Capabilities

What Reposcope sees

Secrets and artifacts, checked for shape

Twenty-six rules read every file found: cloud, version-control, payment and messaging keys, database connection strings, private keys and tokens, plus the artifacts that should never be public, such as scan output, router configurations and kubeconfig credentials. A match is checked for the right shape and never tried against the service it belongs to.

Live search, no mirror

A search runs against each platform's own index at the moment you ask, as an asynchronous job that reports each platform as it finishes. A quick pass sends one query per platform; a full one, where it is open, slices the query to reach past GitHub's 1,000-result search cap. What stays is a deduplicated record of findings, never a copy of the repositories. GitLab is searched for repositories, users and issues rather than code.

How long it has been out

On GitHub and Gitea a finding carries the commit that introduced it, its author and an exposed-since date, so the first question of the incident has an answer. Hugging Face keeps no per-file history, so its findings carry no exposure date rather than an invented one.

Graded like a source

Every finding is graded automatically: a TLP marking, a NATO Admiralty code, and credibility and reliability set by the platform it came from and by whether the match passed its shape check. A critical secret arrives as TLP:AMBER+STRICT.

02The API is the product

Same data, same permissions, over HTTP

Everything the console shows, the API serves. Real endpoint, sample response, masked values.

GET /api/reposcope/findings

REQUEST

curl -H "X-API-Key: sk_••••••••" \
  "https://console.generalintels.com/api/reposcope/findings\
?q=acme.com&has_secret=true&severity=critical&size=20"

RESPONSE · 200

{
  "total": 2,
  "page": 1,
  "size": 20,
  "results": [
    {
      "id": 48213,
      "forge": "github.com",
      "entity": "code",
      "owner": "••••",
      "repo": "••••",
      "path": "deploy/config.yml",
      "url": "https://github.com/••••",
      "severity": "critical",
      "match_counts": {
        "aws-secret-access-key": 1,
        "postgres-connection-string": 1
      },
      "first_seen": "2026-10-14T10:03:12Z",
      "last_seen": "2026-10-14T10:03:12Z",
      "disappeared_at": null,
      "tlp": "TLP:AMBER+STRICT",
      "admiralty_code": "A1",
      "exposed_since": "2025-08-02T16:41:09Z",
      "exposure_days": 438
    }
  ]
}

Owner, repository and URL are redacted in this sample. A list row never carries the secret itself; GET /api/reposcope/findings/{id} returns it with the introducing commit, and that read is logged. Searches are jobs: POST /api/reposcope/search returns a job id at once and GET /api/reposcope/jobs/{id} reports each platform as it finishes. Reading stored findings, as here, spends no search.

Early access

Reposcope is live and in no plan yet. It is open in the free self-serve evaluation, for quick searches, and in a Proof of Concept with us, at full depth and with the API and your own AI over MCP. Every platform search spends from a budget the platforms themselves set, which is why reading your stored findings costs nothing and searching again is what counts.

Ask for a Proof of Concept

Full API reference ships with your workspace: every endpoint, versioned.

03In practice

The config file that went public

10:02

You search for your domain across GitHub, Gitea, GitLab and Hugging Face.

10:03

The quick pass returns a configuration file in a public repository holding a cloud access key and a database connection string.

10:04

The finding names the commit that introduced it, fourteen months ago, from a contractor's account. TLP:AMBER+STRICT, Admiralty A1.

10:30

The key is rotated and the repository owner contacted. Reading the finding again later costs nothing; only a new search does.

Questions

Reposcope, honestly answered

Keep exploring

The other windows

Platform overview

Your competitors will learn about the leak from the invoice.

Learn about it from the log batch.

Start free evaluation Explore the platform

Want the API, your own AI over MCP, or a Proof of Concept run with us? Request a demo

NDA-friendly briefings · global coverage · no slideware