Stop a live key from reaching git history.
AI pastes a real key "just to test" and it lands in a commit — where it lives forever, even after you delete the line. SlopGrade catches the hardcoded secret in the PR, before the merge, and emits only its location — never the value itself.
A production key, committed to source.
The secret is now in the repo and its git history — a rotation is the only real fix, and every clone has a copy. The gate stops it at the PR so rotation is never needed.
What the AI shipped
What leaves your runner
Even a secret match emits only {file, line, kind} — never the secret value. Audit it with --print-payload.
Detect → adapt → verify. Nothing else leaves.
In your runner, on the diff
The open-source client walks the pull request and flags the pattern locally — intra-function dataflow, no code leaves the machine.
Server verdict + gate
The structural fingerprint is classified server-side. A hard hit blocks the check on a paid private repo; public repos are gated free; the paywall fails open.
Posted inline, fix verified locally
The finding is posted on its exact line. Where a fix exists it is generated AND verified in your runner — only offered once a re-scan proves the issue is gone.
Does the secret value get sent anywhere?
No. Even on a match, only the location and kind are emitted — never the value. Run --print-payload to see the exact bytes. This is the whole point of the 0-egress design.
What about test/placeholder keys?
Recognized shapes of live secrets (provider prefixes, high-entropy tokens) are flagged; obvious placeholders and test-mode keys are calibrated out. 0 false positives on 5,000+ repos.