I committed an API key by accident. What now?

Treat it as leaked and replace it with the provider. Removing it from the code isn't enough, because it is still in the history. We find it and report where it is; replacing it is up to you.

Do you see our secrets?

The scanner finds them, but we don't show the value and never send it to an AI model. Your workspace only shows where the secret is.

Do you check whether the key still works?

No. We don't try keys and can't reach your services. We report what is in the code.

Which scanner do you use?

Gitleaks, at a fixed version. It's a well-known open-source scanner that we set next to your tests, your documentation and your architecture.

Do you also look in private repositories?

Yes, with the read access you give, on GitHub, GitLab, Bitbucket or Azure DevOps. You can withdraw it yourself whenever you want.

Find API keys and secrets in your code

Find API keys and passwords in your code and its history

An API key committed by accident stays in the git history, even after you edit the file. We scan your code and the history of your default branch for passwords, keys and tokens, with read access only. For every finding we point to the file and line, without showing the value.

Updated 18 October 2026

Why a removed key is still a problem

Git keeps every version of every file. Take a key out of the code and it still sits in the older commits, for anyone who can read the repository or ever copied it.

So treat a key that was ever in the code as leaked. Editing the file isn't enough: the key has to be replaced with the provider.

What the scan looks for

A well-known open-source scanner at a fixed version, so the same code always gives the same result. No AI is involved in this step.

API keys and tokens of well-known services, such as cloud and payment providers
Passwords and connection details of databases in code or configuration
Private keys and certificates that ended up in the repository
The same patterns in the history of your default branch, including files that are long gone

What you get back, and what you do yourself

For every finding you see where it is: the file, the line and the commit. We never show the value and never send it to an AI model. Files such as .env are skipped.

We advise you to replace the key. We don't do that: we fix nothing and can't reach your services. You decide what to fix and when.

Why on every new version

With AI assistants writing code is fast, and when work is fast, something that doesn't belong ends up in a commit sooner. A scan once a year finds it too late. With continuous checks we look again as soon as there is new code.

The pilot is by invitation. Sign up, we check whether your application fits and email you. You connect your repository with read access only, the first check starts by itself, you see what is checked and what is proven, and then we ask what it is worth to you. Have a question first? Ask it in the message below.

Our team

Reads every sign-up and every question

Our team reads what you send and answers by email. A conversation only happens if you ask for one: with the people who do the work, not a salesperson.