Free plan — one deep scan every 30 days.Paid plans — unlimited deep scans, plus continuous monitoring of new commits.
A regex tells you a string looks like a key. Everything below is what turns that guess into something you can act on.
Every match gets one read-only call to the provider. A key that still answers is an incident, not a pattern hit.
Bundles, source maps, exposed .env and .git. A key in both your history and your live site was never rotated.
Public pushes on GitHub, GitLab and Codeberg are read within seconds — not on a nightly sweep.
Cloud, payments, databases, AI and CI tokens, raw private keys — with 24 provider-specific validators behind them.
A classifier drops test fixtures and documentation examples before a match ever reaches you.
A job posts its diff and fails the build on a live key — one HTTPS call with curl and jq, your diff never stored.
Your source code is never stored — only the matched value and the repo, commit and date needed to act on it.
Live counters from the public API, cached for five minutes. Public repositories only.
Signing in with GitHub grants read-only access. LeakWatch requests the minimum OAuth scope needed to list your repositories and read commits : it cannot push, modify, or delete anything in your account. You can revoke that access at any time from your GitHub settings, and it stops working the moment you do.
No : LeakWatch never stores your source code. A deep scan clones your repository into a short-lived worker to replay its history, and that clone is deleted as soon as the scan finishes. What we keep is the findings themselves: file path, commit, secret type and validation result.
Yes : a site scan reads what your deployed site actually serves — the HTML, the JavaScript bundles, the source maps published alongside them, and configuration files a server exposes by accident such as /.env or a browsable /.git/ directory. A key found in a bundle is live by definition, since nobody removed it from production.
Verifying the domain is what separates a security tool from an attack tool. A site scan probes paths and returns the secrets it finds in the clear, so it only runs on a domain whose owner has proved control — either a DNS TXT record on _leakwatch.yourdomain, or a file under /.well-known/. Ownership is checked again before the report is shown, not only when the scan starts.
Every candidate secret is validated against the provider it belongs to before it is reported as a leak ; an AWS key is tested against AWS, a Stripe key against Stripe, and so on. That verdict, still valid or revoked, is what separates a real leak from a regex match on a random-looking string.
No : the lookup on this page is instant because nothing is cloned or scanned at that moment. It matches your username against leaks already found by our continuous monitoring of public GitHub, GitLab and Codeberg activity. To clone your repositories and replay their full history on demand, run a deep scan.
Yes, and there is nothing to install : a job posts the diff it is about to merge to the API, reads how many secrets came back, and fails the build if that count is not zero. It needs curl and jq, which your CI image already ships — no action from a marketplace, no binary vendored into your runner. What you send is scanned in memory and discarded when the response is sent, never stored and never forwarded. Copy-paste recipes for GitHub Actions, GitLab CI, CircleCI and pre-push hooks are in the CI/CD tab of the documentation.
No account is needed for the free lookup on this page: it works with any public GitHub or GitLab username without signing in. An account is required to scan Codeberg, run a deep scan, see exact files and commit history, or turn on continuous monitoring and alerts.
The one-off scan is free. Upgrade to continuous monitoring to be alerted to every new leak.