Security

Security Check Feature

Repomix uses Secretlint to detect sensitive information in your files:

• API keys
• Access tokens
• Credentials
• Private keys
• Environment variables

Configuration

Security checks are enabled by default.

Disable via CLI:

repomix --no-security-check

Or in repomix.config.json:

{
  "security": {
    "enableSecurityCheck": false
  }
}

Security Measures

1. Binary File Handling: Binary file contents are excluded from output, but their paths are listed in the directory structure for complete repository overview
2. Git-Aware: Respects .gitignore patterns
3. Automated Detection: Scans for common security issues:

• AWS credentials
• Database connection strings
• Authentication tokens
• Private keys

When Security Check Finds Issues

Example output:

🔍 Security Check:
──────────────────
2 suspicious file(s) detected and excluded:
1. config/credentials.json
  - Found AWS access key
2. .env.local
  - Found database password

Best Practices

1. Always review output before sharing
2. Use .repomixignore for sensitive paths
3. Keep security checks enabled
4. Remove sensitive files from repository

Reporting Security Issues

Found a security vulnerability? Please:

1. Do not open a public issue
2. Email: koukun0120@gmail.com
3. Or use GitHub Security Advisories

Related Resources

• Configuration - Configure security checks via security.enableSecurityCheck
• Command Line Options - Use --no-security-check flag
• Privacy Policy - Learn about Repomix's data handling