AGGIB / Stroq
Find known secrets in your AI coding agent sessions (Claude Code, Codex, Cursor), then guard the next one with local hooks that trace risky commands to the content that dictated them. Open source, no telemetry.
- Stars
- 216 stars
- Forks
- 18 forks
- Language
- TypeScript
- License
- APACHE-2.0
- Created
- Sep 4, 2026
- Last push
- Nov 8, 2026
- Updated
- Nov 8, 2026
Why these Tags: an agent read the README and quoted it
- Secrets scanner from the description:
Find known secrets in your AI coding agent sessions (Claude Code, Codex, Cursor)
- Coding agent plugin from the readme:
Its hooks judge every tool call before it runs.
- LLM guardrails from the readme:
they ask you first when a command repeats text the agent read, naming that text.
An agent gave these Tags from the fixed Tag list in the AwesomeRepos source code. A code check kept each Tag only when its quote is in the text. A wrong Tag? Report an error with the form at the end of this page.
Admitted to the Repository Index on Nov 7, 2026: +168 stars in 7 days.
Star History
66 days recorded, Sep 4, 2026 – Nov 8, 2026 (UTC). Net change +221 stars.
The star count of each day is the latest count minus the net stars of the later days.
Add this Star History to a README
The images follow the light or dark theme of the page that shows them, and update every hour.
Add ?theme=light or ?theme=dark
to the chart address to keep one theme.
Star History chart
[](https://awesomerepos.com/AGGIB/Stroq) Badge
[](https://awesomerepos.com/AGGIB/Stroq) Timeline
It gained stars on 13 of the 66 days recorded since Sep 4, 2026.
Its largest 7 days were Nov 2, 2026 to Nov 8, 2026: 203 stars.
In the 30 days to Nov 8, 2026 it got 206 stars, 1960% more than in the 30 days before.
- Created on the Repository Host
- Release v0.27.0
- Release v0.28.0
- Release v0.29.0
- Reached 100 stars, 62 days after it was created
- Largest star day recorded: +113 stars, the same day as release v0.30.0
- Release v0.30.0
- +62 stars in one day
- Entered the Repository Index: +168 stars in 7 days
- +15 stars in one day
- Release v0.31.0
- Latest push
The timeline comes from the creation date and the releases on the Repository Host, the Admission, the Star History, and the Observations. Star milestones show only when the Star History records the day. The list shows up to 5 stable releases from the latest 10 releases recorded. When none of them is stable, one item counts the pre-releases. On the chart of net stars each day, a solid line marks each recorded release.
Forks and pushes
From 2 Observations, Nov 8, 2026 – Nov 9, 2026. Forks +3. AwesomeRepos saw a new push on 1 of 1 days.
- Nov 9, 2026: new push
A filled day: the last push time changed since the Observation before it.
Health facts
Measured facts in four separate dimensions, each with a date and a source. AwesomeRepos does not add them into one score. AwesomeRepos last read these facts from GitHub on Nov 9, 2026. How AwesomeRepos defines each check
Copies a prompt for a coding agent. It has 2 tasks for the maintainers of AGGIB/Stroq.
Improve the Health Facts of the GitHub repository AGGIB/Stroq. AwesomeRepos measures facts about how a repository is maintained, released, secured, and documented. Its page for this repository is https://awesomerepos.com/AGGIB/Stroq. A change to the repository can improve each of the 2 items below. Each item gives the measured fact or score, and a task. The Scorecard result is from 2026-11-09: https://scorecard.dev/viewer/?uri=github.com/AGGIB/Stroq 1. OpenSSF Scorecard Pinned-Dependencies: 8 of 10 Scorecard says: dependency not pinned by hash detected -- score normalized to 8 Task: Pin each GitHub Action in .github/workflows to a full commit SHA, with the version in a comment. Pin container base images by digest. In CI, install from the lockfile with the frozen install command. 2. OpenSSF Scorecard SAST: 9 of 10 Scorecard says: SAST tool detected but not run on all commits Task: Add a workflow that runs static analysis on each pull request, for example GitHub CodeQL for the languages of this repository. Rules for this work: - Each file must be true for this project. Do not copy text that does not apply to it. - Do not choose a licence, a contact, or a release version for me. Ask me. - Do not publish a release, change a repository setting, or push to the default branch. Make the changes on a new branch. - Keep each change small, and run the checks of this repository before you finish. - At the end, list each item as DONE, SKIPPED (with the reason), or NEEDS A DECISION (with the question). AwesomeRepos reads these facts again in its next scan. The definitions of the checks: https://awesomerepos.com/health-facts
Maintenance
3 of 4 checks-
Yes: Not archived
GitHub does not mark the repository as archived. Source
-
Yes: A push in the last 90 days
Last push on 2026-11-08, 0 days ago. Source
-
Yes: Commits in the last 13 weeks
842 commits on the default branch in the last 13 weeks (GitHub, 2026-11-09). Source
-
No: Commits in 26 or more of the last 52 weeks
Commits in 10 of the last 52 weeks (GitHub, 2026-11-09). Source
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 211
- 46
- 136
- 144
- 57
- 15
- 201
- 17
- 3
- 12
Releases
3 of 3 checks-
Yes: A release in the last 365 days
Newest release v0.31.0 on 2026-11-08, 0 days ago. 10 or more releases in the last 365 days. Source
-
Yes: The newest release tag is a semantic version
The newest release tag is v0.31.0. Source
-
Yes: A changelog file at the root
CHANGELOG.md at the root (GitHub, 2026-11-09). Source
Security practice
1 of 1 check-
Yes: A security policy
GitHub finds a security policy (GitHub, 2026-11-09). Source
OpenSSF Scorecard: 18 checks on Nov 9, 2026
Each check has its own score, from 0 to 10. AwesomeRepos does not show the Scorecard aggregate score, and these checks are not in the count above. Source
- Binary-Artifacts
- 10 of 10
- Branch-Protection
- 5 of 10
- CI-Tests
- 10 of 10
- CII-Best-Practices
- 0 of 10
- Code-Review
- 2 of 10
- Contributors
- 3 of 10
- Dangerous-Workflow
- 10 of 10
- Dependency-Update-Tool
- 10 of 10
- Fuzzing
- 10 of 10
- License
- 10 of 10
- Maintained
- 0 of 10
- Packaging
- 10 of 10
- Pinned-Dependencies
- 8 of 10
- SAST
- 9 of 10
- Security-Policy
- 10 of 10
- Signed-Releases
- No result
- Token-Permissions
- 10 of 10
- Vulnerabilities
- 9 of 10
Community files
3 of 3 checksDependencies in the index
This section shows the packages that connect this repository to other repositories in the index.
The GitHub dependency graph of this repository names 42 direct packages (scanned on Nov 9, 2026). Packages from 13 other repositories in the index are among them.
No scanned repository names a package from this repository.
Uses (in the index) · 13
- react/react 252K
npm: react, react-dom
- vercel/next.js 143K
npm: next
- microsoft/TypeScript 112K
npm: typescript
-
npm: @tailwindcss/postcss, tailwindcss
-
npm: prettier
-
npm: @types/node, @types/react, @types/react-dom
- colinhacks/zod 44K
npm: zod
-
npm: motion
-
npm: lucide-react
-
npm: radix-ui
Show all 13
-
npm: @vitest/coverage-v8, vitest
-
npm: tsx
- egoist/tsup 11K
npm: tsup
Used by (in the index) · 0
None.
Sources: the GitHub dependency graph of each repository, and deps.dev for the source repository of each package (checked on Nov 3, 2026). A dependency graph also names development packages. deps.dev takes most source repositories from package metadata. How the dependency graph is made
Observations
Latest Observation, Nov 9, 2026: 216 stars, 18 forks, last push Nov 8, 2026, not archived. One of 2 Observations since Nov 8, 2026.