Docs & quickstart

Quickstart

# Install (Python 3.11+; zero dependencies)
pip install leakpatrol

# Scan the working tree
leakpatrol scan /path/to/repo

# Scan full git history (finds secrets removed in later commits)
leakpatrol history /path/to/repo

# Paid plans: activate the license key issued at checkout
leakpatrol license activate lp1.…

# Scheduled sweep (Team+) — templates ship in the repo's examples/
leakpatrol sweep --config leakpatrol.toml

# JSON report (for CI)
leakpatrol scan --format json /path/to/repo

# Show the revocation runbook for a finding type
leakpatrol runbook aws-access-key

API reference

• CLI-first (stdlib only, zero dependencies). Commands: scan, history, sweep, license, runbook, health.
• `scan [path] [--format text|json] [--alert]` — working tree. Exit 1 when findings exist.
• `history [path] [--max-commits N]` — full git history scan.
• `sweep [--config leakpatrol.toml]` — scheduled history sweep over configured repos (Team+ license). First run baselines silently; later runs Slack-alert on new findings only. Ships with GitHub Actions + cron templates; the schedule runs in your environment.
• `license activate <key>` / `license status` — the signed license key is verified offline on your machine; it never phones home.
• Set LEAKPATROL_ALLOW_ROOT in CI to confine scan targets.
• Full reference: OPENAPI.md in the repo.

The complete reference (every endpoint/command with method, path, auth, and example request/response) ships as OPENAPI.md in the product repo.

Roadmap

Not included today, in the open: SSO/SAML, a findings audit log with acknowledgements, multi-workspace management, an allowlist UI (rule selection + scan scoping exist now), hosted API access, and Jira/Linear ticketing.

Support

Questions? Contact us — a human reads every message.