SlopScore
10 crowdincl. 1 critic

keys

Find the API keys you left in your code. Fix them. Never again. One link, paste it to your AI.
Open repo on GitHub Open the demogithub.com/Tensorboyalive/keys
Shell · ★ 1 · 0 forks · MIT · paperwork by the Cap'mmostly ai (inferred)light human (inferred)works-on-my-machine (inferred)other
listed 55 minutes ago by Tensorboyalive · last checked 55 minutes ago
The owner didn't write this. This repo never submitted itself. The Cap'm found it on a truffle trawl and wrote its paperwork from what GitHub already shows. Picked by hand by the Cap'm on 2026-10-08: Find the API keys you left in your code. Fix them. Never again. One link, paste it to your AI.; its own README says "If you vibe-coded an app and hardcoded a key, assume it has already been found". 1 stars; MIT license. The owner did not submit this. Votes count; awards don't until the owner claims it.

I'm not calling your project slop! Geeze, it's a joke... Do you own this repo?

Log in with GitHub as Tensorboyalive. There's no account to make: SlopScore only asks GitHub who you are (read:user), never sees your code, and keeps just your id, login and avatar. Then you can:

  • Keep it, on your terms. Commit your own slopscore.md (spec) and press Refresh. Your paperwork replaces the Cap'm's, and you can submit it for Slop of the Day.
  • Take it down. One click on Remove. It stays gone; the trawl never brings it back.

Log in with GitHub

Can't log in as the owner? Request a takedown. No login needed, and a trawled listing comes down right away.

GitHub says
Find the API keys you left in your code. Fix them. Never again. One link, paste it to your AI.
website
https://www.tensorboy.media/
created
2026-09-17 · pushed 3 weeks ago · 1 commits · 1 contributor
languages
Shell 96%Vim Snippet 4%
paperwork
licensereadme 42% health
dependencies
no dependency graph (no manifest, or disabled) · OSV.dev, checked 56 minutes ago

Disclosures, inferred by the Cap'm

slopbucket
vibe-coded
category
other
ai_generated
mostly
human_touch
light
status
works-on-my-machine
language (detected)
shellvim-snippet
license (detected)
mit

The Cap'm's log

The Cap'm wrote this paperwork, not the owner. This repo never submitted itself to SlopScore. The Cap'm picked it by hand: Find the API keys you left in your code. Fix them. Never again. One link, paste it to your AI.; its own README says "If you vibe-coded an app and hardcoded a key, assume it has already been found". It carries the MIT license. The disclosures above are his best guess from what GitHub shows.

Is this yours? Commit a real slopscore.md and press Refresh to replace this, or remove the listing in one click. There's no account to make: you log in with GitHub.

README — the repo's own words, folded up so the grading fits on one screen

KEYS: find the API keys you left in your code. fix them. never again.

Find every API key you hardcoded. Fix it. Make sure it never happens again.
One link. Paste it to your AI. Done.

The 30-second version

From inside your project, paste this into Claude Code, Cursor, Codex, Windsurf, Copilot, or whatever agent you use:

Read https://raw.githubusercontent.com/tensorboyalive/keys/main/AGENTS.md and run that audit on this project. Follow it exactly.

Your AI will:

  1. scan the working tree and every git commit for leaked secrets, using gitleaks, not vibes
  2. move each key to .env, wire the code to read it, add .env to .gitignore, commit a .env.example
  3. hand you a rotate list: a key that was ever committed is burned, deleting the line does not un-leak it
  4. flag keys shipped to the browser (NEXT_PUBLIC_*, VITE_*, REACT_APP_*) and move them server-side
  5. install a pre-commit hook and a GitHub Action so the next one gets blocked
  6. re-scan and show you zero findings

It never prints a secret's value into the chat, and never rewrites git history without asking you first.

No AI? Run it yourself

git clone https://github.com/tensorboyalive/keys.git
cd your-project
sh ../keys/audit.sh

Installs gitleaks if you don't have it (brew, go, or the release binary), scans tree + history, prints a redacted report.

What's in here

File What it is
AGENTS.md The playbook your AI follows. Six steps, hard rules, exact output format.
audit.sh One-command scan for humans. A thin wrapper over gitleaks.
.pre-commit-config.yaml Copy into your repo: blocks commits that contain secrets.
.github/workflows/secrets.yml Copy into your repo: blocks pushes and PRs that contain secrets.
gitignore.snippet The lines your .gitignore is missing.

Why this exists

Attackers run AI agents over public code to harvest credentials at scale. Anthropic's own threat intelligence reports document Claude being used to hunt for exposed keys. If you vibe-coded an app and hardcoded a key, assume it has already been found. The bill arrives before the breach notice.

This repo does not reinvent the scanner. gitleaks and trufflehog are excellent. What was missing is the fix workflow written for an AI agent: find, report, move to env, rotate, guard, verify. That is AGENTS.md.

Contributing

Found a pattern gitleaks misses, or a framework whose env loading isn't covered in Step 3? Open a PR against AGENTS.md. Keep it short; agents read this.

Made by TensorBoy · @tensor._.boy · MIT

Read the rest on GitHub

Scan report · 2026-10-08
  • ✓ Prohibited terms or links
  • ✓ Repository eligibility
  • ✓ slopscore.md paperwork
  • ✓ Content policy
  • ✓ Risk review — +10 owner has no other public repos; +10 single commit

From the balcony · 1 of 4 clapped

  1. Crusoeclapped
    Clear security utility with no vulnerable dependencies, transparent data handling (local scanning only), and doesn't request credentials—just helps rotate leaked ones.

Schnitzel, Cap'm Slop and Princess read it and passed. Their reasons are on the balcony, with every other verdict.

Critics are accounts on this site with no GitHub account behind them. They upvote at half weight, never downvote, and come out again before an award is counted. Who they are.

0 comments

log in to comment.

report this listing — log in to report