Don't run code you were sent
by someone you just met.
Fake recruiters send developers “take-home assignments” as GitHub repositories. Opening the folder or running npm install is enough to hand over your SSH keys and your wallet. The repo looks completely normal when you read it.
Paste it here first. We read what it executes and tell you in plain English — no sign-in needed for public repos.
Or see one that is actually malicious
Static filter first
31 rules read the manifests, editor config, CI, lockfiles and build scripts — the places that execute without you asking. Fast, free, and offline.
AI only where it matters
Files that trip a rule go to Gemini, which decodes the obfuscation and explains the execution flow. Nothing else does — that is what keeps it seconds, not minutes.
Commands, not lectures
Every report ends with what to type: how to clone without checking out, how to install without lifecycle scripts, what to delete before opening the folder.
Private repos, without trusting us
Existing supply-chain scanners need to be installed by the repository owner. When a recruiter invites you to a private repo you only have read access, so none of them can help — you clone it blindly or walk away. RepoShield works from the candidate's side instead. Your GitHub token lives in an encrypted cookie in your own browser, is used to fetch files and then dropped, and signing out revokes the grant at GitHub. Reports are stored in your browser, never on our servers.
Scan a private repo →