agent-ready-repo runs locally and requires no API keys, no authentication, and no
network access. It reads files in the target directory and writes only the report and
(in fix mode) starter files. It does not transmit your code anywhere.
Please report security issues privately by opening a GitHub security advisory rather than a public issue.
We aim to acknowledge reports within a few business days.
- Never commit secrets. Use
.env(gitignored). - Document required variable names in
.env.example(names only, no values). - If a secret is committed, rotate it immediately and scrub it from history.
The audit command scans for common committed-secret patterns and leftover
placeholder URLs to help catch these before they ship.