Git Secret Scanner — Leaked API Keys & Credentials (gitleaks)

Scan any public Git repository for leaked secrets — API keys, access tokens, passwords, private keys, database URLs, and 150+ other credential types — powered by gitleaks (MIT), the most widely used open-source secret-detection engine. Discovered secrets are masked by default, so you get the leak's rule, file, line, and commit without re-exposing the raw credential.

Built for developers, security engineers, and DevSecOps teams who need to audit a repository for accidentally committed secrets — before attackers find them.

Legal & ethical notice: This Actor is an unofficial integration of gitleaks (gitleaks/gitleaks) and is not affiliated with or endorsed by the original project. Scan only public repositories that you own or are authorized to audit. Secret values are masked by default. Use the results to remediate leaks, not to exploit them. Comply with all applicable laws and the repository's terms of service.

Free plan vs paid plan

	Free Apify plan	Paid Apify plan
Scan	Full gitleaks scan of the repository	Same full scan
Secret rows	1 secret as a full row (rule, file, line, commit, author, masked value)	Every secret (up to maxResults, max 1,000)
The other secrets	Counted by type in a final free-plan-preview row, e.g. "5 more: 2 aws-access-token, 2 generic-api-key, 1 slack-bot-token"	Full rows

Paid plans also get store discounts: BRONZE -20%, SILVER -35%, GOLD and above -48%. The free-plan limit ends the run as SUCCEEDED with a status message; it is a plan limit, not an error.

What does this Actor do?

Give it a public repo URL (e.g. https://github.com/owner/repo) and it will:

1. Clone the repository (current files, or full commit history if you enable scanHistory).
2. Run gitleaks' 150+ detection rules to find hardcoded secrets.
3. Return each finding — rule, file, line number, commit, and a masked preview of the secret.

Running on Apify gives you scheduling, a REST API, dataset exports (JSON/CSV/Excel), and monitoring — so you can audit repos on a recurring schedule and catch new leaks early.

Why use this Actor?

• Pre-release security audit — make sure no API keys shipped in your code.
• Supply-chain / dependency review — check a third-party public repo before you adopt it.
• Continuous monitoring — schedule scans and diff results to catch newly committed secrets.
• Incident response — quickly enumerate where a leaked credential appears across history.

How to use it

1. Paste a public repo URL (https://github.com/owner/repo).
2. Leave maskSecrets on (recommended). Turn on scanHistory for a deeper, slower scan of every commit.
3. Run it. Each detected secret becomes one dataset row.
4. Export to CSV/JSON/Excel or pull via the API. Schedule for ongoing monitoring.

Input

Field	Type	Description
repoUrl	string	Public HTTPS repo URL (GitHub/GitLab/Bitbucket). Required.
scanHistory	boolean	Scan full commit history (slower, deeper). Default false.
maskSecrets	boolean	Mask secret values in output (default true, recommended).
maxResults	integer	Cap on findings returned/charged (default 200, max 1000).
timeout	integer	Max seconds for clone + scan (default 300).

Output

The first record is the repository row (rowType: "repo-scan"): whether the scan finished, how many secrets were found and how many of each type — counts only, never secret values. Then each detected secret is one dataset record. Download as JSON, HTML, CSV, or Excel.

{
  "repoUrl": "https://github.com/owner/repo",
  "ruleId": "github-pat",
  "secretType": "Uncovered a GitHub Personal Access Token...",
  "filePath": "config/.env",
  "startLine": 12,
  "startColumn": 9,
  "endColumn": 48,
  "commit": "a1b2c3d",
  "secretMasked": "ghp_…ef (len 40)",
  "entropy": "4.42",
  "scannedAt": "2026-06-29T00:00:00+00:00"
}

Data fields

Field	Description
ruleId	gitleaks rule that matched (e.g. aws-access-token, github-pat)
secretType	Human description of the secret type
filePath	File where the secret was found (repo-relative)
startLine	Line number
startColumn / endColumn	Column span of the match on that line
commit	Commit hash (when scanning history)
secretMasked	Masked preview of the secret (full value hidden unless maskSecrets:false)
entropy	Shannon entropy of the match

Pricing / Cost estimation

Event	FREE-tier price	When it is charged
secret-found	$0.05	Once per leaked secret row delivered
repo-scanned	$0.01	Once per run in which gitleaks scanned the whole repository — a clean result is the answer too. Charged from the date this event appears on the Actor's price list
repo-checked	$0.005	Once per run in which the host refused the clone because the repository is private or does not exist (repoStatus: "private-or-missing"), or the repository URL given is not a valid public GitHub/GitLab/Bitbucket HTTPS URL (repoStatus: "invalid-url", nothing is scanned). Charged from the date this event appears on the Actor's price list

Not charged: a clone that failed on our side (network, repoStatus: "clone-failed"), a clone or scan timeout, and notice rows (free-plan-preview, charge-limit-reached, billing-unavailable). If your run's maximum charge is reached, the run stops before the next row and ends SUCCEEDED; every billed row already delivered was paid for. If Apify restarts or migrates a run, the repository row and the secrets it already returned are neither returned nor charged again — repo-scanned and repo-checked stay once per run. A row handed over just before the restart but not yet charged is charged once after it. Two different secrets on the same line are two rows and are both returned. If the Apify charging API fails, the run retries the charge of the row it just returned (up to three times in a row, when the Apify SDK can retry it without charging twice; otherwise not at all) and then stops before the next row (billing-unavailable). Prices are FREE-tier; BRONZE -20%, SILVER -35%, GOLD and above -48%.

Tips & advanced options

• Start with scanHistory:false (fast). Enable it only when you need to find secrets buried in old commits.
• Keep maskSecrets:true — you get the rule, file, and line to remediate without re-leaking the value. Turn it off only on your own repos when you need the raw value.
• Schedule weekly scans and diff results to catch newly committed secrets.

FAQ, disclaimers & support

Is this legal? It scans only public repositories you provide — the same code anyone can git clone. Secrets are masked by default and the tool is intended for defensive auditing and remediation. Scan only repos you own or are authorized to audit, and use findings to fix leaks, not exploit them.

Known limitations: Detection follows gitleaks' rule set; very large histories may hit the timeout (raise timeout or use scanHistory:false). Private repos are not supported (public only).

• Found a bug or need a custom security solution? Open an issue in the Issues tab.

---

🔗 Related Actors by ntriqpro

Build your full security & OSINT stack:

• dnstwist-osint — Typosquatting & phishing domain detector
• maigret-actor — Username OSINT across 3000+ sites
• email-osint-search — Find which 120+ sites an email is registered on
• theharvester-osint — Subdomains, hosts & emails for a domain

⭐ Love it? Leave a Review

Your rating helps other developers secure their repos. Rate it here.