repoclean — Git repo hygiene scanner + secrets detector + pre-commit gatekeeper.

It prevents:

• accidental API key/token leaks
• committing junk artifacts (__pycache__/, .log, .tmp, etc.)
• committing sensitive files (.env, keys)
• bloating git history with large files
• tracked junk already inside git history

It can also act as a gatekeeper:

• prints a health score (0–100)
• blocks risky commits (optional git pre-commit hook)
• CI-friendly JSON output

Most leaks don’t happen because people are careless — they happen because shipping is fast and repo hygiene is manual.

repoclean is a small CLI tool that acts like a repo bodyguard:

• fast hygiene scan
• scary-good secrets detection (real-world token patterns + entropy detection)
• optional git hook that blocks commits automatically
• staged-only mode so checks stay fast and relevant

pip install repoclean-cli

repoclean scan
repoclean secrets
repoclean gate

## Secrets scanner (v0.6.0)

repoclean detects:
- Private key markers (`BEGIN PRIVATE KEY`)
- GitHub tokens (`ghp_`, `github_pat_`, `gho_`)
- Slack tokens (`xoxb-...`)
- Stripe live keys (`sk_live_...`)
- Telegram bot tokens (`123456:ABC...`)
- JWT tokens
- High entropy secret candidates in assignment contexts

repoclean install-hook --mode strict

repoclean ci
repoclean scan --fail-on sensitive,large
repoclean secrets --fail

repoclean scan
repoclean secrets --fail
repoclean fix --yes
repoclean install-hook --mode strict

repoclean secrets --min-severity high
repoclean secrets --fail-on critical
repoclean ci --json

• secrets
• junk
• sensitive
• large
• tracked-junk
• gitignore
• env

repoclean scan

repoclean init

Create a .repoclean.toml config file:

repoclean config init

Preview:

repoclean fix --dry-run --verbose

Apply cleanup:

repoclean fix --yes

### Unstage instead of delete

```bash
repoclean fix --staged-only --unstage --yes

repoclean secrets

Fail mode (useful for CI and hooks):

repoclean secrets --fail

• GitHub tokens (ghp_, github_pat_, gho_)
• Slack tokens (xoxb-...)
• Stripe live keys (sk_live_...)
• Telegram bot tokens (123456:ABC...)
• JWT tokens
• OpenAI keys
• AWS secret access keys
• Google API keys
• high-entropy tokens in assignment contexts

repoclean install-hook --mode strict

Strict mode blocks commits on:

• secrets
• junk artifacts
• sensitive files
• large files

repoclean install-hook --mode warn

Warn mode blocks only secrets

repoclean uninstall-hook

repoclean hook status
repoclean hook print --mode warn
repoclean hook print --mode strict

• repoclean is the command name.
• The PyPI package name is repoclean-cli.