Check your code with RepoGuard
RepoGuard is a built-in plugin that scans a project for security problems, leaked secrets and risky dependencies, grades it, and can start an agent to fix what it found.
RepoGuard is a security checkup for your code. It scans a project for weak spots, leaked passwords and keys, outdated or risky dependencies and setup problems, then gives the project a score from 0 to 100 and a grade from A to F.
Scan a project#
Open Settings > Plugins and turn on RepoGuard.
Open Developer Tools > RepoGuard in the sidebar. It lists your projects.
Pick a project and start a scan: Quick Scan (secrets, dependencies and code quality) or Full Audit (all seven checks).
When it finishes, open the project to see each check's score and the list of findings.
Each finding is sorted into Fix Now, Plan Fix, Improve or Nice to Have, by how serious it is and how much work it takes.
Fix what it found#
Click Fix Issues on a scanned project. RepoGuard starts a Claude session in that project with the scan report and asks it to address every finding. The session uses your Claude plan and asks before risky steps, like any other session.
To keep a copy, click Copy Report: a Markdown report of the scan goes to your clipboard.
More it can do#
Fleet Health: the dashboard shows the average score of every project you have scanned, with each project's grade and trend.
Scan any GitHub repository: paste its address into Paste GitHub URL to scan any repo... to run a Full Audit without adding it as a project.
Live errors from Sentry: if you use Sentry, add a Sentry token and organization in RepoGuard's Plugin Settings (the token is kept encrypted). The Full Audit then includes your app's live error trends.
Turn it off#
Turn off RepoGuard in Settings > Plugins. See Add features with plugins for what plugins may do.
The seven checks in a Full Audit: Security (SAST), Secrets Exposure, Dependencies (SCA), Code Quality, CI/CD & Config, Container Security and Runtime Health (Sentry). A check that does not apply to the project (for example, no containers) is skipped.
Scan Cooldown (minutes) in Plugin Settings (15 at first) stops the same project being scanned again too soon.
Related
- Check the health of a project's codeCodebase Stats sizes up a project folder: its files, code health, git history, packages, test coverage and what its sessions cost.
- See and remove your stored keysStored Keys lists every API key and secret Yardmaster keeps on this computer, by name only, so you can find, replace or delete them without ever showing a value.