Tools

Detects hardcoded passwords, API keys and tokens in Git repos, files and stdin, and can run as a pre-commit hook or GitHub Action to block leaks. Now feature-frozen with security fixes only, as the author has moved on to Betterleaks.

Version datasets and models the way Git versions code: data lives in remote storage like S3 or GCS while versions are tracked in your Git repo. Also offers reproducible pipelines and local experiment tracking, rerunning only the steps affected by a change.

From Trail of Bits: reviews PRs, commits or diffs from a security angle, tracing history with git blame, estimating blast radius by caller count and checking test coverage gaps, then writes a Markdown review report.

Converts and two-way syncs Jupyter notebooks with plain Python scripts or Markdown, so agents can edit research and teaching notebooks like ordinary text and diffs stay readable. Needs a local Python environment; install with pip.

Before tool calls run, blocks destructive Git and file commands (git reset --hard, rm -rf) and access to sensitive files like SSH keys and .env. Parses command semantics, so bash -c wrappers are caught too. Works with Claude Code, Codex and other coding CLIs; needs Node.js 18+.

Skills Sentry's engineering team uses itself: code review, bug finding, security review, writing commits and PRs, and iterating on a PR until CI passes. Maintained by Sentry; some skills follow its internal conventions.