Repo Scan
Scan a whole public GitHub repository for leaked credentials.
Call it
The first response is 402 with the exact price and every rail you can
pay with. Pay, repeat the request with the proof, and you get the result.
curl -X POST https://api.glianalabs.com/v1/tools/repo-scan \
-H 'content-type: application/json' \
-d '{"repo":"sindresorhus/slugify"}'When to use it
Use before an agent trusts a dependency, when auditing your own repository, or when reviewing code someone else wrote. Inputs: repo (required - "owner/name" or a github.com URL), ref (optional branch, tag or commit; default HEAD). Fetches ONE tarball rather than walking the GitHub API, which is rate-limited to sixty requests an hour without a token, so no account is needed on either side. Returns files_scanned, found, high_severity and findings[] with the file path, line number, credential kind and the match REDACTED to its first and last four characters. That redaction is deliberate: it reports WHERE a credential is and never what it is, so it cannot be used to collect keys out of other people repositories. Binaries, images and vendored directories are skipped, and a repository over 25 MB compressed is refused free rather than truncated silently. Matches are shapes, not proof - a key in a test fixture looks exactly like a live one, and this does not check whether any still work.
What it costs
$0.0200 per successful call — flat, with no plan, minimum or monthly fee. A call that fails validation is refused before it runs, so it is never charged.
Not sure this is the right endpoint? GET /v1/consult?intent=… is
free and answers that.
Often used with this
Secret Scan
$0.0020Find credentials left in a block of text. Use before an agent commits code, pastes a log into a ticket, or acts on a file it did not write.
Typosquat
$0.0040Find lookalike domains that are actually registered.
Osint Brief
$0.0120Profile a contact or an organisation from open sources, in one call, and say why it looks the way it does.