Repository preflight. Free and open source.

A closer look.Before you run.

Repyy reviews unfamiliar take-home repositories before you install dependencies, start the project, or open it in your IDE.

View the demo reportInstall Repyy

Static analysis can identify risks, but it cannot prove that a repository is safe.

How it works

Files in. Evidence out.

Start with a local folder or Git URL. Keep assignment-controlled commands unexecuted while you review.

Read the files.

Start with a folder or Git URL. Repyy reads scripts and configuration as data, without intentionally running assignment code.

Trace the evidence.

Checks connect suspicious patterns to source locations, with severity, confidence, and coverage kept visible.

Make the call.

Review the report. Inspect the source, ask for context, use stronger isolation, or stop.

Illustrative workflow. Static analysis helps you review; it cannot prove a repository is safe.

What the scan checks

Look beyond the source files.

Static checks look for patterns across install paths, automation, encoded payloads, credentials, metadata, and archives.

01 / Execution pathsInstall paths

A closer look at the paths that can execute.

Read the files. Leave the code still.
package.jsonlifecycle scripts2 signals.github/workflowsautomationchecked.vscode/tasks.jsoneditor taskscheckedfixtures/sample.ziparchive depth 1checked

Lifecycle scripts, custom registries, unexpected binaries, and download-to-execute chains are evaluated together.

02 / Finding modelSeverity ≠ confidence
SeverityHighPotential impact
ConfidenceMediumStrength of the evidence

Severity and confidence remain separate so review signals are not presented as proof of compromise.

03 / Encoded behaviorHidden code.
Visible intent.
What you seeeval(atob("ZmV0Y2goLi4uKQ=="))
What it containsfetch(...)

A network request, wrapped in an instruction to run it.

Illustrative pattern. Encoding alone does not prove malicious intent.

Code can hide what it does behind encoded text. Repyy flags decoding and execution patterns for you to inspect.

04 / Redacted evidenceCredentials

Recognized credential-shaped values are redacted. Review reports for sensitive content before sharing.

Keep the evidence.
05 / Repository surfacesBeyond the app folder

CI, editor tasks, agent instructions, containers, Git hooks, archives, and social-engineering signals remain in scope.

There is more than src/.

Coverage limits

Every scan has a boundary. If a timeout, limit, or read error reduces coverage, repyy reports the scan as incomplete.

10 minDefault timeout
100,000Default file limit
50 MiBDefault per file
3 levelsArchive depth

These defaults are adjustable. They are not detection guarantees.

Trust, with evidence

A clear boundary.
An inspectable tool.

Local scans keep source and reports on your machine. Remote retrieval needs network access. Static analysis can miss malicious behavior and flag legitimate code.

Read Trust and Limitations ↗
Trace the release.Signatures, SBOMs and build provenance. Check which evidence exists for your version.Inspect the testing.CodeQL, regression tests and bounded fuzzing, with known gaps documented.Reproduce the results.Inert fixtures, paired controls and visible misses. No universal accuracy claim.
Independent review is pending.A prepared scope is available. No external audit is claimed.

Report formats

The same evidence. A view that fits.

Read it in your terminal, pass it to automation, or keep an offline report. Recognized sensitive values are redacted. Review the report before sharing.

Terminal review
$ repyy scan ./assignment

REVIEW REQUIRED
2 findings need context

HIGH  PKG-001   package.json:12
MED   OBFS-003   src/setup.js:48

See it before installing

See the report before you install.

Explore 11 inert risk examples and their paired controls, scanned with the 0.6.0 preview code.

Open the demo ↗

No relevant findings does not prove safety. Understand statuses and incomplete coverage ↗

Get started

Start with a scan.

Install repyy. Scan the assignment. Review what comes back.

$ brew install --cask Kevin-Umali/tap/repyy
Installation guide ↗Verify your download ↗

Before you begin.

Does “No findings” mean the repository is safe?

No. It means the completed scan matched no enabled rule. Static analysis can miss malicious behavior and can report harmless code.

Can I scan private repositories?

Yes. HTTPS clones can use supported provider tokens. SSH remotes use your existing SSH agent.

Can a repository weaken its own scan?

No. Repository-owned .repyy.yaml files are ignored. Pass a configuration file you trust with the --config flag.