AI API Key Leak Scanner: GitHub Repos + URLs

Find leaked OpenAI, Anthropic, AWS, Stripe and other API keys in public GitHub repositories and public JS / config URLs before someone else does. Give it owner/repo names or URLs; get one row per target with every finding: file, line, rule, severity and a masked match, plus where to rotate it. No GitHub token, no install. $0.01 per repository or URL scanned.

Use cases

• Pre-launch check of your own repos. Run it on every repository in your organisation before you open-source one or ship an AI app.
• Agencies and freelancers handing code over to a client: attach the clean scan.
• Security teams and bug bounty hunters checking a programme's public repositories and front-end bundles (in scope only).
• Scheduled monitoring. Put it on an Apify schedule and get a dataset (or webhook) every day.

What it detects (26 rules, 33 patterns)

OpenAI keys · Anthropic keys · AWS access key IDs and secret keys · Google API keys · Google service-account JSON · GitHub classic and fine-grained tokens · Slack bot/user tokens and webhooks · Stripe live and test keys · Twilio SIDs/keys · SendGrid · Mailgun · Supabase service-role and anon keys · Vercel tokens · Heroku API keys · Firebase Cloud Messaging keys · JWTs · PEM private keys · hardcoded passwords · Bearer tokens in code · generic api_key = "..." assignments · private values in .env files.

It is the same rule set as our AI App Secrets Scanner browser tool, run across a whole repository instead of one pasted file.

Output (a real run)

From a test run on 2026-10-28 against trufflesecurity/test_keys (a public repository of deliberately leaked test keys):

{
  "target": "https://github.com/trufflesecurity/test_keys",
  "type": "repository",
  "filesScanned": 3,
  "findingsCount": 3, "high": 3, "medium": 0, "low": 0,
  "findings": [
    {"file": "keys", "line": 1, "rule": "PEM Private Key", "severity": "high", "match": "----…----", "note": "Never commit private keys; use a secrets manager"},
    {"file": "new_key", "line": 2, "rule": "AWS Access Key ID", "severity": "high", "match": "AKIA…ZAM2", "note": "Rotate in AWS IAM"}
  ]
}

Matches are always masked (first 4 and last 4 characters). The dataset tells you what to rotate and where; it never hands anyone a working key.

Input

Field	Default	What it does
repositories	none	owner/repo or https://github.com/owner/repo. Default branch, read from GitHub's public zip download.
urls	none	Public text, JS bundle or config URLs, each fetched once.
minSeverity	low	medium or high to cut noise.
maxFilesPerRepo	3000	Binaries, files over 1 MB, lock files, node_modules, vendor, dist and build are always skipped.

Pricing

Pay per event: $0.01 per repository or URL scanned. A private, missing or unreachable target is reported with its error and not charged. 100 repositories = $1.00.

Rules of use

Scan code you own or are authorised to assess. If you find a live key in someone else's public repository, tell the owner (GitHub's secret scanning partner programme also revokes many token types automatically). Regex rules give false positives (test keys, example values) and can miss custom formats, so treat findings as leads for a human to check.

More Actors by johnveds15

• Local business leads + Shopify store finder
• OpenVuln CVE and vulnerability scanner