UnLeak — Find Leaked API Keys in Your GitHub

Scan your own GitHub repos and old commits for leaked API keys and secrets. Runs locally. Nothing is uploaded.

Deleting a secret from your code does not remove it from your Git history. Anyone can still read it in an old commit. UnLeak scans your own repos and their history for real credentials, then shows you how to revoke each one. WHAT IT LOOKS FOR UnLeak recognizes 18 kinds of credentials, including cloud access keys, payment processor keys, AI service keys, messaging and email service tokens, database connection strings, and private key files. WHY IT IS DIFFERENT - Reads history, not just current code, a key you deleted last year still shows up. - Fewer false alarms, thanks to entropy and placeholder filtering. - Every finding comes with revoke steps for that provider, sorted by urgency. - Only scans repos you own. PRIVATE BY DESIGN Runs entirely in your browser. No UnLeak server. Your token stays in local Chrome storage and only ever talks to GitHub's API. Secrets are shown masked and never saved. No analytics or tracking. GET STARTED Install, click the icon, paste a read-only GitHub token (the link is built in), and hit Scan.