Every secret our scanner picks up across public GitHub and GitLab activity, as it happens. The list refreshes on its own, and each type is colored by the kind of provider it belongs to.
Only the provider prefix of each key is shown, and the repository is never disclosed — this page reports that leaks happen, it does not help anyone find them.
Right now this feed carries JWT, HashiCorp Terraform Password, Telegram Bot API Token, Database Connection String and Groq API Key, plus 9 other key types, spread across 6 provider families: databases, AI providers, cloud infrastructure, payment processors, messaging and email, private keys.
How LeakWatch's secret-detection rules moved from five hand-synced Python tables to 381 self-contained YAML files, the test that reads them independently of the loader, and the Sourcegraph false positive that migration just caught.
Recall 0.168 → 0.518 on Samsung's CredData: what the benchmark told us about regex + LLM secret detection, and the one promising idea we refused to ship.
Why real-time monitoring can't see the key you leaked in 2021, and how LeakWatch's deep scan clones your repo, replays every commit on every ref, and does it without ever being able to touch someone else's code.
How LeakWatch ingests thousands of public commits per minute without knocking over the forges' APIs: ETag caching, a rotating token pool, circuit breakers, and distributed dedup via Redis.
A calm, step-by-step guide for when you just leaked a secret to a public repo: rotate first, clean history second, check for abuse third — with the exact commands and provider links.
Inside the LeakWatch pipeline: ingesting the public commit firehose, 400+ regex patterns, heuristic and ML false-positive filtering, and strictly read-only secret validation.
Want this feed as JSON? The same detections are available through the LeakWatch API — search by account, pull recent leaks, or scan your own repositories.