Pantheon-Security/medusa
A command-line scanner that checks a git repo, or your own machine, for API keys leaked into chat and shell history and for risky AI config files, such as Claude Code hooks that run shell commands. It can redact the keys it finds and writes reports as JSON, HTML or SARIF.
Idea adaptedKey files read, not run
I learnt this repo's idea and adapted it into my own workspace setup.
How we know
We read the README and key files, not every source file, and did not run it, so the most we can say is Idea adapted or Risky.
Good for
Developers who want to check a repo, or their own AI tool folders, before they trust it or share it.
Not for
Anyone wanting a full security program; it matches known patterns, so new attacks can slip past, and its AGPL license may not suit closed-source teams.
Repo
- Stars
- None
- License
- AGPL-3.0Like GPL, and running it as a web service counts too: people who use your service can ask for your source code.
- Maturity
- active
- Last push
- Last checked
- 2026-11-14