How to Find Leaked API Keys in a GitHub Repo
Leaked API keys are the most common security hole in AI-built apps. Here's how to check any public GitHub repo for exposed secrets in two minutes. Free, no signup.
The single most common security hole in AI-built apps is also the easiest to check for: a leaked API key sitting in a public repo. AI coding tools inline keys they saw in examples; developers hardcode one "just to test" and commit it. Either way, the moment it's pushed publicly, it's compromised.
This how-to is for anyone who wants to confirm their GitHub repo isn't leaking secrets, in about two minutes, with no signup.
Step 1: Run a free leak scan
The fastest check is a scanner that reads your repo's files for the patterns secrets follow: sk-... for OpenAI, sk_live_... for Stripe, AKIA... for AWS, and dozens more.
- Open the free scanner.
- Paste your public GitHub repository URL.
- Read the results: exposed keys, their type, and the file they're in.
SecuriVibe's scanner does this without cloning your repo and works on any public repository. (For private repos, the full Launch scan connects via the GitHub App.)
Step 2: Rotate anything it finds
If the scan turns up a key, rotate it immediately: generate a new one and revoke the old one at the provider. This is the part people skip, and it's the only part that matters: deleting the line from your code does not help, because the key is still in your git history and in every clone or fork that already pulled it. Treat any key that was ever pushed publicly as burned. GitHub's removing-sensitive-data guide explains why history rewrites alone aren't enough.
Step 3: Stop it happening again
- Keep secrets in environment variables, never in committed files.
- Add a
.gitignoreentry for.envand local config. - Consider a pre-commit secret scanner or GitHub's push protection.
- Re-scan after big AI-assisted changes: tools like Cursor will happily inline a key again.
Why this is worth two minutes
A leaked OpenAI or Stripe key can be drained or abused within hours of hitting a public repo: automated scrapers watch GitHub for exactly these patterns. Leaked keys are hole #1 in our roundup of the 8 security holes AI coding tools leave, and the cheapest to close. If you want the full picture beyond secrets, start with securing a vibe-coded app.
Check your repo now
Run a free scan: paste a public GitHub URL and see what's exposed in under two minutes. No signup required.
Frequently asked questions
How do I check if my GitHub repo has leaked API keys?
Paste your public repo URL into a key-leak scanner like SecuriVibe's free /scan, which checks files for the patterns API keys follow (OpenAI, Stripe, AWS, and more) without cloning. You'll get a list of exposed secrets and where they are, in under two minutes.
What do I do if I find a leaked API key?
Rotate it immediately: generate a new key and revoke the old one. Removing the line from your code is not enough, because the key remains in git history and in anyone's existing clone. Rotation is the only real fix.
Can deleting a commit remove a leaked secret?
Not reliably. Even after a rewrite, the secret may persist in forks, caches, and clones that already pulled it. Assume any key that was ever pushed publicly is compromised and rotate it, rather than trusting history rewrites.
How do leaked keys end up in repos in the first place?
Usually an AI coding tool inlines a key it saw in an example, or a developer hardcodes one for a quick test and commits it. Keeping secrets in environment variables, never in committed files, prevents it.
Check your repo in two minutes.
Paste a public GitHub URL and SecuriVibe scans it for leaked keys. Free, no signup. Or book a full Launch scan.
Keep reading