# LeakWatch - Find Leaked API Keys in your Repos > LeakWatch scans public GitHub, GitLab and Codeberg for leaked secrets, checks the JavaScript bundles and config your site actually serves, and flags any key exposed on both sides. Source: https://leakwatch.net/ --- [LeakWatch](/) [Product](/product)[Pricing](#pricing)[Live feed](/leaks)[Blog](/blog)[Docs](/docs)Sign in # Your secrets are already exposed We help you find them org/payments-serviceStripe secret keygitlabapi.startup.ioGitHub tokensitedevteam/infraGoogle API keygithubapp.fintech.coFirebase configsiteorg/legacy-workerPostgreSQL URIgithubuser/mobile-appMongoDB URIgitlabacme/data-pipelineDatadog API keygithubmaint/build-toolsCloudflare tokencodebergteam/notificationsGitLab runner tokengitlabuser/backend-apiSupabase service keygithub org/payments-serviceStripe secret keygitlabapi.startup.ioGitHub tokensitedevteam/infraGoogle API keygithubapp.fintech.coFirebase configsiteorg/legacy-workerPostgreSQL URIgithubuser/mobile-appMongoDB URIgitlabacme/data-pipelineDatadog API keygithubmaint/build-toolsCloudflare tokencodebergteam/notificationsGitLab runner tokengitlabuser/backend-apiSupabase service keygithub github.com/ Scan leakwatch.net/dashboard OverviewDeep scanProjectsLeaked keysAPI accessCI/CDCustom patternsSettings Your exposure9 repos · last scan 4s ago Secrets 27 Repositories 9 Still valid 12 By severity criticalhighmediumlow Detectionslast 24h acme/payments-apiStripe live secret keystill valid devon/dotfilesGitHub personal access tokenstill valid acme/infra-toolsSlack webhook URLrevoked mira/side-projectSendGrid API keyrevoked acme/data-syncPostgreSQL connection stringunverified vela/ops-runnerDatadog API keystill valid acme/webGoogle Maps API keyrevoked noor/scratchOpenAI API keystill valid * * * Deep scan Every key you ever committed — not just the ones still there The full history, back to the first commitAll branches and tags, not just the default oneYour own repositories only — ownership is verified Sign in to run a deep scan **Free plan** — one deep scan every 30 days.**Paid plans** — unlimited deep scans, plus continuous monitoring of new commits. * * * Continuous monitoring We scan public GitHub, GitLab and Codeberg commits continuously and index every secret we detect. Instant lookup Enter your username to check instantly whether a leak linked to your account is already known. Scan the site you deployed Verify a domain you own — we read bundles, source maps, .env and .git as a visitor would, then flag any key that is both in your repo and live. Unlock full protection Subscribers see exactly where each leak was found and get real-time alerts on every new commit. * * * Watched GitHubGitLabCodeberg Alerts on SlackDiscordEmail * * * Detection engine ### Built to catch what others miss A regex tells you a string looks like a key. Everything below is what turns that guess into something you can act on. validation · live probe Stripe live secret keystill valid GitHub personal access tokenalready revoked AWS access keystill valid #### Tested against the provider Every match gets one read-only call to the provider. A key that still answers is an incident, not a pattern hit. #### Reads your site, not just your repo Bundles, source maps, exposed `.env` and `.git`. A key in both your history and your live site was never rotated. #### Scanned as commits land Public pushes on GitHub, GitLab and Codeberg are read within seconds — not on a nightly sweep. #### 400+ detection patterns Cloud, payments, databases, AI and CI tokens, raw private keys — with 24 provider-specific validators behind them. - + #### False positives filtered A classifier drops test fixtures and documentation examples before a match ever reaches you. #### A CI gate with nothing to install A job posts its diff and fails the build on a live key — one HTTPS call with `curl` and `jq`, your diff never stored. Your source code is never stored — only the matched value and the repo, commit and date needed to act on it. * * * Stop leaks in their tracks ### Detect and block secrets before they spread Initial commita1b2c3d A developer pushes code to a public repository. Everything looks clean. Setup projecte4f5g6h Config files, environment setup, dependencies. Business as usual. Add API keyx7y8z9a**secret** found A live secret slips into the commit. LeakWatch flags it within seconds and alerts you instantly. API\_KEY = "sk-live-4f9a•••••••••••" CI pipeline blockedc9d0e1f**exit** 1 The same engine runs in your pipeline. The build fails on the secret, so the commit never reaches main. [Set up the CI gate](/docs?tab=ci) leakwatch scan . → 1 secret found, exit 1 Revoke keyb1c2d3e**401** revoked Alert received, key rotated and revoked — before anyone could exploit it. * * * By the numbers ## What the scanner has seen so far 124.5K secrets detected since launch, across GitHub, GitLab and Codeberg 1.2K found in the last 24 hours alone 400+ detection patterns, each tested against the provider that issued the key 0 lines of your code kept — a scan reads, reports, and stores nothing Live counters from the public API, cached for five minutes. Public repositories only. * * * FAQ ## Before you sign in ### What access does signing in with GitHub give you? Signing in with GitHub grants read-only access. LeakWatch requests the minimum OAuth scope needed to list your repositories and read commits : it cannot push, modify, or delete anything in your account. You can revoke that access at any time from your GitHub settings, and it stops working the moment you do. ### Is my code stored anywhere? No : LeakWatch never stores your source code. A deep scan clones your repository into a short-lived worker to replay its history, and that clone is deleted as soon as the scan finishes. What we keep is the findings themselves: file path, commit, secret type and validation result. ### Can LeakWatch scan my live website, not just my repository? Yes : a site scan reads what your deployed site actually serves — the HTML, the JavaScript bundles, the source maps published alongside them, and configuration files a server exposes by accident such as /.env or a browsable /.git/ directory. A key found in a bundle is live by definition, since nobody removed it from production. ### Why do I have to verify my domain before scanning it? Verifying the domain is what separates a security tool from an attack tool. A site scan probes paths and returns the secrets it finds in the clear, so it only runs on a domain whose owner has proved control — either a DNS TXT record on \_leakwatch.yourdomain, or a file under /.well-known/. Ownership is checked again before the report is shown, not only when the scan starts. ### How do you avoid flagging false positives? Every candidate secret is validated against the provider it belongs to before it is reported as a leak ; an AWS key is tested against AWS, a Stripe key against Stripe, and so on. That verdict, still valid or revoked, is what separates a real leak from a regex match on a random-looking string. ### Does the scan on this page rescan my account right now? No : the lookup on this page is instant because nothing is cloned or scanned at that moment. It matches your username against leaks already found by our continuous monitoring of public GitHub, GitLab and Codeberg activity. To clone your repositories and replay their full history on demand, run a deep scan. ### Can I run LeakWatch in my CI/CD pipeline? Yes, and there is nothing to install : a job posts the diff it is about to merge to the API, reads how many secrets came back, and fails the build if that count is not zero. It needs curl and jq, which your CI image already ships — no action from a marketplace, no binary vendored into your runner. What you send is scanned in memory and discarded when the response is sent, never stored and never forwarded. Copy-paste recipes for GitHub Actions, GitLab CI, CircleCI and pre-push hooks are in the CI/CD tab of the documentation. ### Do I need an account to scan? No account is needed for the free lookup on this page: it works with any public GitHub or GitLab username without signing in. An account is required to scan Codeberg, run a deep scan, see exact files and commit history, or turn on continuous monitoring and alerts. * * * Pricing ## Continuous secret monitoring The one-off scan is free. Upgrade to continuous monitoring to be alerted to every new leak. Free 0€ Forever Access to affected repositories Leaks type and severity One deep scan every 30 days One site scan every 30 days Commit details in your deep scan only No continuous monitoring Start for free 14-DAY FREE TRIAL Solo 4.99€/month Free for 14 days, then 4.99€/month · cancel anytime **39.99€**/year−33%**99.99€**lifetime Continuous monitoring Real-time email / discord / slack alerts Commit details on every leak Liveness checks & dismissal on every leak Unlimited deep scans Start 14-day free trial Cancel before day 14 and you are not charged LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)