Stop malicious repos before they run.
Fake job tests and poisoned packages steal SSH keys, cloud credentials and crypto wallets the moment you runnpm install. RepoSentry checks every repo you clone and blocks the dangerous ones first.
- macOS and Windows
- Checks in seconds
- Your code stays on your machine
$ git clone github.com/talent-hq/frontend-take-home
Cloning into quarantine…
RepoSentry ▸ checking 214 files before anything can run
✓ src/ ✓ README.md ✓ vite.config.ts
✗ package.json "postinstall": "node scripts/setup.js"
↳ eval(Buffer.from("aW1wb3J0IG9z…", "base64"))
↳ reads ~/.ssh, Chrome “Login Data”, MetaMask vault
↳ sends them to 45.61.xxx.xxx:1224
✗ .vscode/tasks.json runs on folder open
⛔ BLOCKEDMalicious. npm install stopped. Nothing ran.
Dangerous repo blocked
frontend-take-home tries to steal your SSH keys and crypto wallets.
The problem
Cloning is safe. Running isn’t.
Attackers now target developers directly, because one laptop holds the keys to everything.
Fake job interviews
A “recruiter” sends a take-home project. Running it installs a stealer that empties wallets and grabs every saved password.
Poisoned packages
Typosquatted or hijacked npm packages hide a postinstall script that runs the second you install dependencies.
Auto-run editor tasks
A hidden .vscode/tasks.json runs code just by opening the folder in VS Code or Cursor. No install needed.
How it works
A checkpoint between git clone and disaster
- 1
Clone into quarantine
Paste a link, or just git clone as usual. Hooks, submodules and symlinks stay disabled until it’s checked.
- 2
Fast local scan
A compiled Rust engine looks for install scripts, obfuscation, credential theft and auto-run files in seconds.
- 3
AI verdict
Only the suspicious snippets go to AI, which explains what the code really does and how dangerous it is.
- 4
You decide
A native notification shows the verdict. Block it, delete it, or allow it once. Nothing runs without you.
Features
Every way in, covered
Protection that runs quietly in the background, from the first clone to the last push.
Install-script gate
Most malware fires from preinstall and postinstall. RepoSentry blocks install scripts from running until the repo is cleared.
$ npm install
⏸ paused: 2 packages want to run install scripts
esbuild@0.21.5 trusted
color-utilz@1.0.3 new package · obfuscated · blocked
Push guard
A pre-push hook stops hidden, obfuscated or curl | sh code from ever reaching your repos.
Secret leak guard
Commits containing API keys, private keys or .env files are blocked before they leave your laptop.
Decoy credentials
Fake keys and wallet backups are planted on your machine. If a thief uses them, you hear about it instantly.
Dependency risk
Flags typosquats, brand-new packages, sudden publisher changes and suspicious fresh releases.
Message check
Paste a recruiter or client message to spot the fake-interview scam before you even clone.
Shared threat network
When one user finds a malicious repo, it’s blocked for everyone, before it’s even downloaded.
“I ran something” recovery
Stops processes from the repo, lists new startup items and gives you a key-rotation checklist.
Privacy first
Security software you can trust with your code
Scanned on your machine
The full repo never leaves your computer. Rules run locally in compiled Rust.
Only flagged snippets analysed
Just the few suspicious lines are sent for an AI verdict, never your whole codebase.
Nothing silently changed
RepoSentry never edits code. It blocks, explains and lets you choose.
For teams
See every threat across your whole team
Onboarding new developers, hiring contractors or sending take-home tests? Give your security lead one dashboard for everyone’s machines.
- Real-time alerts. In the dashboard and in Slack, Teams or Discord the moment someone meets malicious code.
- Required protection. Choose protections that are switched on and locked on every employee’s computer.
- Coverage at a glance. See which computers are fully protected and which need attention.
- Transparent to employees. Admins see check results, never anyone’s code.
Employees
24 / 25
Protected
96%
Threats, 30d
7
- 2m
Sara K. in web3-trading-bot
Malicious code found
- 1h
Bilal A. in payments-api
Push blocked
- 3h
James O. in ui-kit-fork
Risky code found
Illustrative preview of the company dashboard
Pricing
Cheaper than one stolen key
Simple plans. Cancel any time.
Individual
For developers who clone code from strangers.
$9/ month
Billed yearly at $99
Get RepoSentry- Up to 2 computers
- Repo checks on clone and pull
- Install-script gate
- Secret and push guards
- Decoy credentials
- Message check and recovery mode
Team
For companies onboarding and hiring developers.
$15/ seat / month
Billed yearly · 2 computers per seat
Start for your team- Everything in Individual
- Company dashboard
- Real-time alerts
- Slack, Teams and Discord
- Required protection policies
- Coverage per computer
Enterprise
For large teams with security and compliance needs.
Custom
50+ seats
Contact sales- Everything in Team
- Volume pricing
- Onboarding support
- Priority threat review
- Invoice billing
Does RepoSentry upload my code?+
No. Repos are scanned on your computer. Only the few lines that look suspicious are sent for an AI verdict, never the whole project.
Will it slow down git or npm?+
Local checks take a few seconds and run in the background. You only see RepoSentry when something looks dangerous.
Does it change or delete my code?+
Never on its own. It blocks and explains. You choose to allow, block or delete.
What do I need to install?+
Just the app. On Windows, Git must be installed (git-scm.com). Windows 10/11 already includes everything else.
How do I sign in after buying?+
You’ll get an email with your account details. Download the app, sign in, and protection turns on automatically.
Can my company see my code?+
No. On team plans, admins see check results and alerts, never the contents of your repositories.
Clone anything. Run nothing bad.
Download RepoSentry and sign in with the account from your purchase email.