# About — LeakWatch

> Who runs LeakWatch, why it exists, and how the scanning works — no sales pitch, just the facts.

Source: https://leakwatch.net/about

---

[← LeakWatch](/)

# Why you got an issue from me

If a GitHub/GitLab/Codeberg issue pointed you here — this is the whole story.

## Who I am

![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp)

I'm Gabriel Diyan — 0xCr0c0 online, a cybersecurity student, and I run LeakWatch: an independent service dedicated to detecting and reporting exposed credentials in public repositories. Notifications are sent for prevention: they allow the relevant maintainers to quickly verify the situation and take the necessary measures, including revoking and replacing the credentials.

I write every article on this site myself, and I wrote the scanner they describe — the detection patterns, the false-positive classifier and the provider validators.

[GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) · Email: [security@leakwatch.net](mailto:security@leakwatch.net)

## Which LeakWatch this is

The name is not exclusive, and the confusion is real enough to be worth a paragraph. This site — LeakWatch Scan, at leakwatch.net — scans public git repositories for leaked API keys. It is not leakwatch.org, the non-profit that monitors breach dumps for personal data; not Leakwatch, the cybersecurity consultancy based in Valenciennes, France; not the open-source CLI scanner published under the same word on GitHub; and not the weekly security column of that name on igorslab.de.

If you were looking for one of those, you're in the wrong place — and if someone told you LeakWatch contacted them about a leaked key, it was this one. See [the legal notice](/legal) for who publishes it.

## What LeakWatch actually does

LeakWatch scans public commits on GitHub, GitLab and Codeberg for exposed credentials — API keys, database connection strings, tokens — and checks whether they're still live against the provider's own API before flagging them. Nothing intrusive: it only reads what's already public in git history.

The one-off heads-up on your repo is, and always will be, free — I don't gate a security warning behind a paywall. Continuous monitoring across an account is the part that's a paid plan, for people who want to catch the next one before a stranger has to open an issue about it.

## The numbers, as of today

113,059

secrets detected

2,621

confirmed still-active

51,203

found in the last 30 days

3

platforms covered — GitHub, GitLab, Codeberg

Scanning the public firehose since May 2026. Counted on 22 August 2026 — these are hardcoded on a static page, so treat them as a floor, not a live reading.

## What I'll never do

I won't publish your repo or username publicly, condition a security warning on payment, or message you more than once about the same finding if you don't respond. If any of that ever happens, it's a bug in how I'm running this tell me at the email above.

LeakWatch

Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about).

Scan

-   [Product](/product)
-   [Live feed](/leaks)
-   [Trends](/leaks/trends)
-   [API docs](/docs)
-   [CI/CD](/docs?tab=ci)

Read

-   [Blog](/blog)
-   [Changelog](/changelog)
-   [About](/about)

Verify

-   [Security](/security)
-   [Privacy](/privacy)
-   [Terms](/terms)
-   [Legal](/legal)
-   [Contact](/contact)
-   [Status](https://status.leakwatch.net)

© 2026 LeakWatch

[GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)