News
URL Scan vs GitHub Deepen for OPSEC Audits
April 16, 2026
URL scan vs GitHub deepen is a visibility split, not two competing products. A public URL audit sees what the internet already gets: headers, cookies, mixed content, robots.txt, and well-known path leaks. GitHub deepen, when you authorize it, reads repository contents you choose — committed secrets, reckless Actions permissions, lockfile risk — things HTTP cannot see. Start with a URL you own. Add GitHub only if that repo actually ships the site. RoastMyOpsec does not scan private networks or run exploit payloads in either mode.
The practical difference
The website is the costume. The repo is the dressing room. A clean costume with .env in git history is still an incident. A locked-down repo with .git on the CDN is still an incident. You need the surface that matches the leak.
OAuth deepen is optional and scoped. A URL roast never requires connecting GitHub.
How to choose what to run this week
If you shipped a marketing site this month, run website mode on that host. If the same team pushes to GitHub and you suspect history is messy, deepen the repo that builds that host — not a random org dump.
| Question | URL scan | GitHub deepen | Takeaway |
|---|---|---|---|
| Are headers and cookies adult? | Yes | No | HTTP is the source of truth |
| Is .env on the CDN? | Yes (path probes) | Maybe also in git | Fix the edge and rotate |
| Did someone commit a cloud key? | Only if it shipped in JS | Yes — history included | Rotate; purge if you still control history |
| Are Actions overly trusted? | No | Yes | Repo-only finding |
When deepen is the wrong next click
Connecting a monorepo that is not the site you just roasted wastes time. Connecting a repo you do not own is against the product's consent model. If the leak is mixed content, GitHub will not rewrite the CMS.
If the URL already showed public JS secrets, rotate first, then deepen to see whether git still holds the old key.
Common mistakes
The first mistake is treating a 9/10 URL score as a clean repo.
The second mistake is deepening a fork that never deploys.
The third mistake is leaving GitHub connected after the one-time check if you did not intend a standing grant.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does a URL scan replace a git secrets review?
- No. The URL cannot see commits that never shipped to the CDN. Deepen is how you inspect a repo you authorize.
- Is GitHub required for RoastMyOpsec?
- No. Optional. The free audit is the public URL. Deepen adds repo-level findings on the same report.
- Will deepen download my entire company?
- It reads repositories you authorize for the check types documented — secrets, Actions, lockfile risk — not a pentest of GitHub the company.