Secret Scanner API

Scan text, a file, a diff or a ZIP of a repo for leaked API keys, tokens, private keys and passwords with the 220+ gitleaks rules. Secrets are masked.

Parameters

Example

curl -X POST "https://apibox.io.vn/v1/secret-scan" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text":"AWS_ACCESS_KEY_ID=AKIAQWERTYUIOPASDFGH\nDATABASE_URL=postgres://admin:S3cr3tP4ssw0rd!@db.example.com:5432/app\n","filename":".env"}'

const res = await fetch('https://apibox.io.vn/v1/secret-scan', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "text": "AWS_ACCESS_KEY_ID=AKIAQWERTYUIOPASDFGH\nDATABASE_URL=postgres://admin:S3cr3tP4ssw0rd!@db.example.com:5432/app\n",
    "filename": ".env"
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/secret-scan",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"text": "AWS_ACCESS_KEY_ID=AKIAQWERTYUIOPASDFGH\nDATABASE_URL=postgres://admin:S3cr3tP4ssw0rd!@db.example.com:5432/app\n", "filename": ".env"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/secret-scan');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"text":"AWS_ACCESS_KEY_ID=AKIAQWERTYUIOPASDFGH\\nDATABASE_URL=postgres://admin:S3cr3tP4ssw0rd!@db.example.com:5432/app\\n","filename":".env"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "leaks_found": true,
  "count": 2,
  "files_scanned": 1,
  "characters_scanned": 109,
  "by_rule": {
    "aws-access-token": 1,
    "url-credentials": 1
  },
  "findings": [
    {
      "rule_id": "aws-access-token",
      "description": "Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.",
      "file": ".env",
      "line": 1,
      "column": 19,
      "end_line": 1,
      "end_column": 38,
      "secret_masked": "AKIA**************GH",
      "match_masked": "AKIA**************GH",
      "entropy": 3.984,
      "confidence": "high",
      "fingerprint": ".env:aws-access-token:1"
    },
    {
      "rule_id": "url-credentials",
      "description": "Password inside a URL / connection string (database, broker, FTP, HTTP basic auth).",
      "file": ".env",
      "line": 2,
      "column": 31,
      "end_line": 2,
      "end_column": 45,
      "secret_masked": "S3***********d!",
      "match_masked": "postgres://admin:S3***********d!@db.example.com:5432",
      "entropy": 3.507,
      "confidence": "high",
      "fingerprint": ".env:url-credentials:2"
    }
  ],
  "truncated": false,
  "rules": {
    "count": 222,
    "source": "gitleaks default config (MIT)",
    "dropped": 0
  },
  "ms": 5,
  "privacy": "The text is scanned in memory and not stored or logged; secrets are masked in the response."
}

Use cases

• Check logs or a support ticket for keys before pasting them into an LLM
• Light pre-commit or CI check on a diff without installing a scanner
• Audit a ZIP of a project handed over by a contractor
• Catch database passwords left in .env or config files

FAQ

Related APIs