# AI API Key Leak Scanner: GitHub Repos + URLs (`johnveds15/ai-api-key-leak-scanner`) Actor

Scan public GitHub repositories and public text/JS URLs for leaked API keys: OpenAI, Anthropic, AWS, Google, GitHub, Slack, Stripe, Twilio, Supabase, Vercel, PEM keys, JWTs and hardcoded passwords. 26 rules. Matches are masked. $0.01 per repo or URL scanned.

- **URL**: https://apify.com/johnveds15/ai-api-key-leak-scanner.md
- **Developed by:** [John Vedovino II](https://apify.com/johnveds15) (community)
- **Categories:** Developer tools, AI
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$10.00 / 1,000 repository or url scanneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## AI API Key Leak Scanner: GitHub repos + URLs

**Find leaked OpenAI, Anthropic, AWS, Stripe and other API keys in public GitHub repositories and public JS / config URLs before someone else does.** Give it `owner/repo` names or URLs; get one row per target with every finding: file, line, rule, severity and a **masked** match, plus where to rotate it. No GitHub token, no install. **$0.01 per repository or URL scanned.**

### Use cases

- **Pre-launch check of your own repos.** Run it on every repository in your organisation before you open-source one or ship an AI app.
- **Agencies and freelancers** handing code over to a client: attach the clean scan.
- **Security teams and bug bounty hunters** checking a programme's public repositories and front-end bundles (in scope only).
- **Scheduled monitoring.** Put it on an Apify schedule and get a dataset (or webhook) every day.

### What it detects (26 rules, 33 patterns)

OpenAI keys · Anthropic keys · AWS access key IDs and secret keys · Google API keys · Google service-account JSON · GitHub classic and fine-grained tokens · Slack bot/user tokens and webhooks · Stripe live and test keys · Twilio SIDs/keys · SendGrid · Mailgun · Supabase service-role and anon keys · Vercel tokens · Heroku API keys · Firebase Cloud Messaging keys · JWTs · PEM private keys · hardcoded passwords · Bearer tokens in code · generic `api_key = "..."` assignments · private values in `.env` files.

It is the same rule set as our [AI App Secrets Scanner](https://vedovino.gumroad.com/l/dnkrjd) browser tool, run across a whole repository instead of one pasted file.

### Output (a real run)

From a test run on 2026-10-28 against `trufflesecurity/test_keys` (a public repository of deliberately leaked test keys):

```json
{
  "target": "https://github.com/trufflesecurity/test_keys",
  "type": "repository",
  "filesScanned": 3,
  "findingsCount": 3, "high": 3, "medium": 0, "low": 0,
  "findings": [
    {"file": "keys", "line": 1, "rule": "PEM Private Key", "severity": "high", "match": "----…----", "note": "Never commit private keys; use a secrets manager"},
    {"file": "new_key", "line": 2, "rule": "AWS Access Key ID", "severity": "high", "match": "AKIA…ZAM2", "note": "Rotate in AWS IAM"}
  ]
}
```

**Matches are always masked** (first 4 and last 4 characters). The dataset tells you what to rotate and where; it never hands anyone a working key.

### Input

| Field | Default | What it does |
|---|---|---|
| `repositories` | none | `owner/repo` or `https://github.com/owner/repo`. Default branch, read from GitHub's public zip download. |
| `urls` | none | Public text, JS bundle or config URLs, each fetched once. |
| `minSeverity` | `low` | `medium` or `high` to cut noise. |
| `maxFilesPerRepo` | 3000 | Binaries, files over 1 MB, lock files, `node_modules`, `vendor`, `dist` and `build` are always skipped. |

### Pricing

Pay per event: **$0.01 per repository or URL scanned.** A private, missing or unreachable target is reported with its error and not charged. 100 repositories = $1.00.

### Rules of use

Scan code you own or are authorised to assess. If you find a live key in someone else's public repository, tell the owner (GitHub's secret scanning partner programme also revokes many token types automatically). Regex rules give false positives (test keys, example values) and can miss custom formats, so treat findings as leads for a human to check.

### More Actors by johnveds15

- [Local business leads + Shopify store finder](https://apify.com/johnveds15/local-business-leads-shopify)
- [OpenVuln CVE and vulnerability scanner](https://apify.com/johnveds15/openvuln-cve-scanner)

# Actor input Schema

## `repositories` (type: `array`):

owner/repo or https://github.com/owner/repo. The default branch is scanned. Only scan code you own or are authorized to assess.

## `urls` (type: `array`):

Each URL is fetched once and scanned as text, e.g. https://yoursite.com/static/app.js

## `minSeverity` (type: `string`):

Drop findings below this level.

## `maxFilesPerRepo` (type: `integer`):

Text files over 1 MB, binaries, lock files, node_modules, vendor and build folders are always skipped.

## Actor input object example

```json
{
  "repositories": [
    "octocat/Hello-World"
  ],
  "urls": [],
  "minSeverity": "low",
  "maxFilesPerRepo": 3000
}
```

# Actor output Schema

## `results` (type: `string`):

One row per repository or URL with masked findings.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "repositories": [
        "octocat/Hello-World"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("johnveds15/ai-api-key-leak-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "repositories": ["octocat/Hello-World"] }

# Run the Actor and wait for it to finish
run = client.actor("johnveds15/ai-api-key-leak-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "repositories": [
    "octocat/Hello-World"
  ]
}' |
apify call johnveds15/ai-api-key-leak-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,johnveds15/ai-api-key-leak-scanner"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/B8IyYt0KXaUtTQv8s/builds/tYx3JjWawdKNqJ3rw/openapi.json