Open source · Python · v0.4.0
leakscan
A pure-Python CLI that finds leaked API keys and secrets in source trees, staged changes, git history and public GitHub profiles, and checks whether they still work.
- Problem
- Secrets get committed, deleted and pushed, but they stay in git history. The common scanners need Docker, a config file or a Go binary before the first scan.
- What I built
- 107 detection patterns across severity tiers, Shannon-entropy scoring, history and staged-diff scanning, read-only live verification for 32 services, SARIF output and a built-in pre-commit hook. Each finding explains its blast radius, where to rotate the key, and who committed it.
- Engineering decision
--stagedscans only the diff about to be committed, so the pre-commit hook stays near-instant on large repos. Full scans are multi-threaded with chunked reads to keep memory flat.- Evidence
- 3,800+ downloads, 117 tests across Python 3.10 to 3.12 in GitHub Actions, and installs via pip, pipx, uv, Homebrew and a VS Code extension.
$ pip install leakscan
$ leakscan scan . --history --verify
[CRITICAL] AWS Access Key ID
File: config.py:3
Match: AKIAIOSFODNN7EXAMPLE
Blast radius: Full cloud account compromise
Rotate at: console.aws.amazon.com/iam
Git blame: commit a1b2c3d (45d ago, main)
Secret age: 45d scraping risk: CRITICAL