Security & Compliance · Leaked secret response

LeakResponder

From leaked key to closed incident.

Find every leaked secret in your files and git history, rotate them in the right order, and prove it's done.

Software companies without a security teamAgencies handing repositories to clientsAnyone who just got an exposed-secret alert

Book a LeakResponder demo See pricing

leak-responder · example

$ leak-responder scan .
leak-responder: 4 secret(s) in .: 1 critical, 2 high, 1 low
‼ CRITICAL AWS access key ID AKIAQ7…NL: removed from the files but still in git history
! HIGH     Database URL with password: deploy.sh:2
! HIGH     GitHub token ghp_a1…R8: deploy.sh:1
  LOW      Stripe test key: only in test files

Real run on the sample repository from the product's test suite.

ScansFiles and full git history

PlansRotation order

Runs onYour laptop, server or CI

ProvesClosure evidence

The problem

GitHub or a scanner tells you a key leaked. The hard part is the next two days: which secret first, how to rotate each one, did anyone use it, and proof for the customer or auditor that it's fixed.

What it does

Scans current files and every commit on every branch; git-ignored files like your local .env are skipped

AWS, Google Cloud, Azure, GitHub, GitLab, Stripe, Razorpay, Slack, OpenAI, Anthropic, database URLs, private keys and more

Ranks by danger: live cloud and payment keys first, keys only in tests lower, public repositories raised

Response runbook per secret: how to revoke it, where to look for misuse since the commit date, how to confirm it's dead

Owner and status tracker in CSV; verify passes only when every secret is rotated and gone from the files

Secrets are never printed in full, written to reports or sent anywhere; no production credentials needed

How it works

Scan the repository and its history
Rotate each secret with the runbook and mark it in the tracker
Run verify and keep the result as your evidence

Works with

GitGitHubAWSStripeSlackGoogle Cloud

Runs in your CI

GitHub Actions workflow step

- uses: actions/checkout@v5
- run: leak-responder scan . --no-history --fail-on high   # fails on any high or critical secret

Licensed customers get the action or command-line tool installed in their own organisation; it runs on your runners, so your code and plans never leave them. The command-line tools run in GitLab CI the same way.

Your data

Runs locally on your clone.
Secrets are reported as fingerprints, not values.
Evidence stays with you.

Who it's for

Software companies without a security teamAgencies handing repositories to clientsAnyone who just got an exposed-secret alert

Questions

Why does order matter?

Rotating a key before its dependants are updated causes an outage; the plan sequences them safely.

Does it rewrite history?

It tells you when that's needed and how; it doesn't rewrite anything itself.

Often used with LeakResponder

Security & Compliance

MaskWall

AI data firewall

Use AI. Keep your secrets. A protective layer between your company and every AI service. Keys, passwords and customer data are blocked or masked before they leave, and quietly restored in the reply.

$199–499/month (₹8,000–25,000 in India)View product → Security & Compliance

PrivacyPilot

DPDP privacy compliance

Privacy compliance, made practical. Find the gaps between your website and India's DPDP Act, and get the privacy notice, data inventory and consent banner to close them. Notices are checked against GDPR, UK, US and Australian rules too.

₹2,999 per siteView product → Security & Compliance

CERT-In Ready

CERT-In compliance check

CERT-In, checked properly. Check your infrastructure against the CERT-In Directions as written: 180 days of logs held in India, synchronised time and incident reporting.

₹25,000–75,000View product →

← PreviousBreachClock Next →PipelineDoctor

See LeakResponder on your own data

A 30-minute call. We run the product on your export, repository or document and walk you through the results.

Book a demo