Be notified instantly after a secret, API key, or other credential leaks onto the public internet. Protect your organization from data breaches before they happen.
Secure Your Secrets Nowarn:aws:iam::876543210987:user/SecurityEngineer
So far, we have scanned 0 GB of data across the internet.
| Marker Type | Value |
|---|---|
| AWS account ID | 643109630515 |
| GitHub org | acme-corp |
| GitHub org | acme-oss |
| Domain name | acme.com |
0. You configure organization markers, for example, domain names and AWS account IDs.
| Organization Markers | |
|---|---|
| AWS account ID | 643109630515 |
| GitHub org | acme-corp |
| GitHub org | acme-oss |
| Domain name | acme.com |
1. User accidentally uploads a file containing a secret, exposing it publicly.
2. SecretScanner.io continuously monitors public web platforms for new data
3. All previously unseen objects are downloaded.
4. Downloaded data is recursively decoded, for example decompressed and base 64 decoded
5. Secrets are detected from content
6. Secret metadata is compared with your organization markers
7. Notification is sent out to your organization about the leaked secret!
Our pricing model is as simple as it can get.
$2,000/year
For organizations of all sizes
A single data breach can damage your reputation and cost millions. Our automated scanning helps you stay ahead of threats and avoid catastrophic financial losses. Read more
We offer our services for free to open source project
organizations.
Contact
[email protected]
to set up a free account.
Traditional scanners are limited to resources you explicitly define in scope, like your own GitHub repositories. This approach misses secrets that leak into unexpected public locations.
Our platform works differently by continuously scanning certain high-risk platforms on the public Internet. Instead of defining a narrow scan scope, you provide "organization markers" (e.g., your AWS account IDs or company domains). When we find a matching secret anywhere online, we notify you.
Furthermore, our AI-powered engine uses advanced content decoding to find secrets that other tools miss. It automatically detects and unpacks multiple layers of encodings (like Base64, ZIP, and GZIP), ensuring comprehensive discovery even within complex files like application binaries.
We provide real-time scanning for public data on GitHub and Docker Hub, two of the most common sources for accidental secret leaks.
We are continuously expanding our coverage, with support for Pastebin, the iOS App Store, and the Google Play Store planned for late 2025.
We currently detect a wide range of high-risk secrets, including:
Yes. We continuously expand our detection capabilities based on customer feedback and emerging threats. If you need a specific secret type monitored, please contact our team at [email protected] to discuss your requirements.
Our scanning cluster is designed to process new data as quickly as possible. For smaller files (<128 MB), notifications are typically sent within 15 minutes. Larger files may take longer to process, up to several days.
While our standard service does not include a formal Service Level Agreement (SLA) on detection times, custom SLAs are available. Please contact [email protected] for more information.
Yes. Our system archives findings from its continuous scans. If we have previously discovered a secret matching your organization, you will be notified within 1-2 hours of configuring your markers, allowing you to address historical leaks immediately.
No. Our annual plan includes unlimited alerts. We believe in providing complete visibility without penalizing you for active remediation.
Absolutely. Once you sign up, you have access to a dashboard that provides 30-day overview of our scanning operations, updated in real time. You can view key metrics for each platform, including total data scanned (in terabytes), objects scanned, and valid secrets found.
You can be up and running in under five minutes. Simply click "Sign Up," create your account, configure your organization markers and notification channels, and our scanners will begin protecting your organization immediately.
Absolutely. We offer a free, no-obligation trial so you can experience the full capabilities of our platform and see its value for yourself. Please contact us at [email protected] to request your trial.