Direct answer
Does DevDock upload source code while scanning for secrets?
DevDock runs a read-only baseline security audit across every registered folder. It identifies recognizable provider tokens, possible hardcoded secrets, private keys, tracked credential files, escaping symlinks, unsafe permissions, and missing dependency lockfiles while withholding matched secret values.
Best for
Where this workflow fits.
- Checking a repository before a release or handoff
- Reviewing several registered repositories in one product
- Keeping sensitive source code on the local machine during the scan
Local project data, operating-system secret storage, read-only local audits, and no source upload.
Relevant capabilities
What DevDock brings to the job.
Practical workflow
From setup to a reviewed result.
Add a project
Register a local project folder and give it a clear place in the sidebar.
Review the workspace
See its folders, health, saved commands, and recent activity from one overview.
Run a command
Start a saved workflow and follow its output from the project view.
Return from Today
Open recent work or a pinned daily workflow without hunting for the project again.
Useful in practice
Related searches
One workflow, several common names.
This page focuses on source-code secret scanner. People also describe the same or closely related job as local secret scanner, hardcoded secrets scanner, credential leak checker, repository security audit.
Direct answers
Questions about source-code secret scanner.
Does DevDock upload source code while scanning for secrets?
DevDock runs a read-only baseline security audit across every registered folder. It identifies recognizable provider tokens, possible hardcoded secrets, private keys, tracked credential files, escaping symlinks, unsafe permissions, and missing dependency lockfiles while withholding matched secret values.
Does DevDock replace the terminal?
No. It provides a repeatable control surface for common project workflows and can still open a registered folder in a terminal, Visual Studio Code, or File Explorer.
Does project detection run repository code?
No. Detection reads a bounded set of manifests and marker files. It does not execute package managers, build tools, project scripts, or network requests.
Go deeper
Run DevDock's read-only local security audit, understand each finding, complement it with ecosystem advisory scanners, and respond without exposing secrets.
Read Local project security audits and dependency checks