Code Audit API — leaked secrets + OSV dep scan

Code Audit API — leaked-secret scanning and dependency vulnerability checks as a service, designed for CI gates, dev-tool integrations, and AI coding agents that want to refuse to ship dangerous code.

Two endpoints

• — regex scan for AWS / GitHub / OpenAI / OpenRouter / Stripe / Slack / Google API keys, PEM private keys, JWTs, and assigned passwords. Returns findings with 1-based line numbers and a redacted preview (we never echo the actual secret back).
• — parse a (npm) or (PyPI) and query the public OSV.dev vulnerability database for each pinned version. Returns only the vulnerable packages with their CVE / GHSA IDs.

What this isn't — not a deep static analyzer, not a SAST replacement, not an SCA suite. It's a fast, predictable, agent-friendly check for the two highest-signal issues that 95% of "did we leave a secret in the repo?" / "are any of our deps known-bad?" questions need.

Plans — Starter $9/mo (25 scans, $0.10 overage) · Pro $29/mo (200 scans, $0.05 overage).