Catch leaked secrets at the next commit, CI run, or sweep.
LeakPatrol scans your working tree and your full git history for leaked credentials — 11 secret types via regex plus entropy heuristics — and tells you exactly how to rotate each one. Flat pricing. No per-seat meter.
The problem: a leaked key is an open wallet
An AWS key committed to git is an open wallet. GitGuardian's State of Secrets Sprawl 2026 counted 28.65 million new hardcoded secrets added to public GitHub in 2025 alone, up 34% year over year. And a 2026 census by Truffle Security validated 543,699 still-live credentials sitting in public code — median exposure 784 days (figures as reported by the publishers). Undetected is the default state of a leaked secret.
The incumbents meter the fix: GitHub Secret Protection costs $19–$30 per active committer per month. GitGuardian's paid tiers are quote-based. Small teams either pay up or go without.
And the working tree is only half the story — secrets removed in later commits are still live in git history, in every clone, forever, until rotated.
Scan everything, rotate first
Two scans: the working tree (what's there now) and full git history (what was committed and 'removed'). The history scan finds the secrets everyone else misses.
Every finding ships with a revocation runbook, and every runbook says the same thing first: rotate FIRST, purge history second. Deleting the commit without rotating leaves the key live in every clone.
$49/mo flat for the whole team — unlimited devs, unlimited repos. GitHub charges $19–$30 per committer per month to watch your secrets.
What you get
Working-tree scan
Scan any directory for 11 secret types: AWS keys, Stripe keys, GitHub tokens, private keys, database URLs, and more.
Git history scan
Walks git log to find secrets committed and later removed — the case working-tree scans miss.
Entropy heuristics
High-entropy token detection catches the secrets no regex knows about. Stated honestly: regex + entropy, never 'AI-powered'.
Redacted previews
Full secret values never appear in output, JSON reports, or Slack messages — previews are truncated by design.
Revocation runbooks
Per-secret-type ordered steps: rotate first, purge history second, audit the blast radius.
CI-ready JSON output
Exit 0 clean / 1 findings / 2 config error. Fail the build on leaked secrets.
Scheduled sweeps (Team+)
The sweep command runs the history scan on your own schedule — GitHub Actions and cron templates included — and Slack-alerts only on NEW findings. The first run sets a silent baseline, so there is no week-one alert flood.