Why you got an issue from me
If a GitHub/GitLab/Codeberg issue pointed you here — this is the whole story.
Who I am
I'm Gabriel Diyan — 0xCr0c0 online, a cybersecurity student, and I run LeakWatch: an independent service dedicated to detecting and reporting exposed credentials in public repositories. Notifications are sent for prevention: they allow the relevant maintainers to quickly verify the situation and take the necessary measures, including revoking and replacing the credentials.
I write every article on this site myself, and I wrote the scanner they describe — the detection patterns, the false-positive classifier and the provider validators.
GitHub · X · LinkedIn · GitHub (personal) · Email: [email protected]
Which LeakWatch this is
The name is not exclusive, and the confusion is real enough to be worth a paragraph. This site — LeakWatch Scan, at leakwatch.net — scans public git repositories for leaked API keys. It is not leakwatch.org, the non-profit that monitors breach dumps for personal data; not Leakwatch, the cybersecurity consultancy based in Valenciennes, France; not the open-source CLI scanner published under the same word on GitHub; and not the weekly security column of that name on igorslab.de.
If you were looking for one of those, you're in the wrong place — and if someone told you LeakWatch contacted them about a leaked key, it was this one. See the legal notice for who publishes it.
What LeakWatch actually does
LeakWatch scans public commits on GitHub, GitLab and Codeberg for exposed credentials — API keys, database connection strings, tokens — and checks whether they're still live against the provider's own API before flagging them. Nothing intrusive: it only reads what's already public in git history.
The one-off heads-up on your repo is, and always will be, free — I don't gate a security warning behind a paywall. Continuous monitoring across an account is the part that's a paid plan, for people who want to catch the next one before a stranger has to open an issue about it.
The numbers, as of today
Scanning the public firehose since May 2026. Counted on 22 August 2026 — these are hardcoded on a static page, so treat them as a floor, not a live reading.
What I'll never do
I won't publish your repo or username publicly, condition a security warning on payment, or message you more than once about the same finding if you don't respond. If any of that ever happens, it's a bug in how I'm running this tell me at the email above.