leaked

Fast secret & credential scanner for codebases and git history

---

leaked scans your codebase and git history for accidentally committed secrets — API keys, tokens, passwords, private keys, and more. It detects 50+ secret types with zero configuration and presents results in a beautiful terminal UI.

Why leaked?

Secrets accidentally committed to git are the #1 cause of credential breaches. Once pushed, they live forever in git history — even after deletion. leaked catches them before damage is done.

Feature	leaked	truffleHog	gitleaks
Beautiful terminal UI	✅ Rich panels & tables	❌ Plain text	❌ Plain text
Zero config	✅ Works instantly	❌ Needs setup	✅
Pre-commit hook	✅ Built-in	✅	✅
Git history scan	✅	✅	✅
Pure Python	✅ pip install	❌ Go binary	❌ Go binary
CI exit codes	✅	✅	✅
JSON export	✅	✅	✅

Installation

pip install leaked

Or from source:

git clone https://github.com/mimonimo/leaked.git
cd leaked
pip install -e .

Quick Start

Scan Current Directory

# Scan all files in current directory
leaked scan

# Scan a specific path
leaked scan /path/to/project

# Scan a single file
leaked scan config.py

Scan Git History

# Scan entire git history
leaked git-scan

# Scan last 50 commits
leaked git-scan -n 50

# Scan specific branch
leaked git-scan -b feature/auth

Pre-Commit Hook

# Test on staged files
leaked pre-commit

# Add to .git/hooks/pre-commit:
#!/bin/sh
leaked pre-commit

Or with pre-commit:

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/mimonimo/leaked
    rev: v1.0.0
    hooks:
      - id: leaked
        entry: leaked pre-commit
        language: python

CI/CD Integration

# GitHub Actions
- name: Scan for secrets
  run: |
    pip install leaked
    leaked scan --exit-code

# GitLab CI
secret-scan:
  script:
    - pip install leaked
    - leaked scan --exit-code

Export Results

# JSON output
leaked scan -j results.json
leaked git-scan -j history-results.json

List Rules

# See all 50+ detection rules
leaked rules

What It Detects

leaked ships with 50+ detection rules across 13 categories:

Cloud & Infrastructure

Rule	Severity	Example Pattern
AWS Access Key ID	CRITICAL	AKIA...
AWS Secret Access Key	CRITICAL	aws_secret_access_key = ...
GCP Service Account Key	CRITICAL	"type": "service_account"
GCP API Key	HIGH	AIza...
Azure Storage Key	CRITICAL	AccountKey=...
HashiCorp Vault Token	CRITICAL	hvs.xxx

Version Control

Rule	Severity	Example Pattern
GitHub PAT (classic)	CRITICAL	ghp_...
GitHub Fine-Grained Token	CRITICAL	github_pat_...
GitLab PAT	CRITICAL	glpat-...
NPM Token	CRITICAL	npm_...
PyPI Token	CRITICAL	pypi-...

Payment & Communication

Rule	Severity	Example Pattern
Stripe Secret Key	CRITICAL	sk_live_...
Slack Bot Token	HIGH	xoxb-...
SendGrid API Key	HIGH	SG.xxx.xxx
Twilio API Key	HIGH	SK...
Discord Webhook	MEDIUM	discord.com/api/webhooks/...

AI & ML

Rule	Severity	Example Pattern
Anthropic API Key	CRITICAL	sk-ant-api03-...
OpenAI API Key	CRITICAL	sk-...T3BlbkFJ...
OpenAI Project Key	CRITICAL	sk-proj-...

Cryptography & Auth

Rule	Severity	Example Pattern
Private Key (RSA/EC/DSA)	CRITICAL	-----BEGIN PRIVATE KEY-----
JWT Token	MEDIUM	eyJhbG...
Database Connection String	CRITICAL	postgres://user:pass@host
Basic Auth in URL	HIGH	https://user:pass@host
Hardcoded Password	MEDIUM	password = "..."

Additional Categories

• E-commerce: Shopify tokens
• Messaging: Telegram, Discord bots
• Monitoring: Datadog API keys
• Container: Docker Hub PATs
• Package Registry: NPM, PyPI tokens

Example Output

╔═══════════════════════════════════════════════════════╗
║                                                       ║
║    _            _            _                        ║
║   | | ___  __ _| | _____  __| |                      ║
║   | |/ _ \/ _` | |/ / _ \/ _` |                      ║
║   | |  __/ (_| |   <  __/ (_| |                      ║
║   |_|\___|\__,_|_|\_\___|\__,_|                      ║
║                                                       ║
║   v1.0.0 — Secret & Credential Scanner                ║
║                                                       ║
╚═══════════════════════════════════════════════════════╝

  Target: /home/user/my-project
  Rules:  50 detection patterns loaded

   ⚠ Found 3 potential secret(s)
  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
     Severity   Type                    File           Line
  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  ✘  CRITICAL   AWS Access Key ID       config.py        12
  ✘  HIGH       Slack Bot Token         .env.example      3
  ⚠  MEDIUM     Suspicious File         .env              0

╭─────────────── 🔎 Scan Summary — my-project ────────────────╮
│ ╔═══════════════════════╤════════════════════════════════╗   │
│ ║ Status                │           ✘ 3 SECRET(S) FOUND ║   │
│ ║ Files scanned         │                           142 ║   │
│ ║ Files skipped         │                            38 ║   │
│ ║ Duration              │                         0.34s ║   │
│ ║                       │                               ║   │
│ ║   ✘ CRITICAL          │                             1 ║   │
│ ║   ✘ HIGH              │                             1 ║   │
│ ║   ⚠ MEDIUM            │                             1 ║   │
│ ╚═══════════════════════╧════════════════════════════════╝   │
╰─────────────────────────────────────────────────────────────╯

How It Works

1. File Scanner — Walks the directory tree, skipping binaries, node_modules, .git, etc. Reads each text file and matches against all rules.
2. Git Scanner — Iterates through git commits, extracts diffs, and scans added lines for secrets. Catches secrets that were committed and later removed.
3. Pre-commit Scanner — Only checks staged changes (git diff --cached), so it runs in milliseconds.

Smart Defaults

• Automatically skips binary files, images, fonts, archives
• Skips node_modules, .git, __pycache__, venv, dist, build
• Masks detected secrets in output (shows first 4 chars + ****)
• Files > 1MB are skipped to maintain speed
• Results sorted by severity (CRITICAL first)

Configuration

Exclude Patterns

# Exclude test fixtures
leaked scan -e test_fixtures -e mock_data

# Multiple excludes
leaked scan -e "*.test.js" -e "fixtures/"

For CI Pipelines

# Exit with code 1 if any secrets found
leaked scan --exit-code

# Minimal output (no previews)
leaked scan --no-preview --exit-code

Ethical Use

leaked is designed to help developers find and remove accidentally committed secrets from their own repositories. Always use this tool responsibly and only on codebases you have authorization to scan.

Contributing

Contributions welcome! Areas of interest:

• New detection rules for additional services
• Custom rule configuration (YAML/TOML)
• Entropy-based secret detection
• IDE integrations

License

MIT License — see LICENSE for details.

---

Made with security in mind by @mimonimo