Overview
MokoGIT includes built-in security scanning in two layers: secret detection that blocks risky pushes before they land, and static code analysis that flags common vulnerability patterns. Both are managed per repository, with a REST API for alerts, configuration, and on-demand scans.
Secret detection (block-on-push)
When enabled, MokoGIT inspects the changes in every push at the pre-receive stage. If a push introduces something that looks like a credential — an API key, token, private key, and similar — the push is rejected before the commit is stored, so the secret never enters the repository history.
- The scan reads the push diff, not the whole tree, so it is fast and focused on what you are actually adding.
- If a match is a false positive, an allowlist lets you record known-safe patterns (repository and admin/global scopes) so they stop blocking.
Code analysis
Static analysis scans your repository for common vulnerability classes, including SQL injection, cross-site scripting (XSS), command injection, and path traversal, among others. Findings are surfaced as alerts you can review, triage, and resolve.
Managing alerts and scans
- Review findings in the repository’s security view; each alert links to the offending code.
- A REST API exposes alerts, scanner configuration, and an on-demand scan trigger for automation and dashboards.
- Secret-block enforcement can be required organization-wide as part of the push policy (see Branch Protection & Organization Governance).
Get help
Open a support ticket or call (931) 279-6313.