8 Free Tools That Catch Leaked API Keys (2026)

Leaked API keys rarely look dramatic. A key ends up in a config file, an old commit or a frontend bundle, and nobody notices until a bill shows up or the data is out.

It's getting worse. GitGuardian's State of Secrets Sprawl 2026 counted 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34% on the year before.

This list covers the whole job. Find the key, check if it still works, revoke it, scrub it from git history and stop the next one before it's pushed. Every tool here is free.

Every link below was opened and checked on 2026-10-08. Nothing here is sponsored.

1. Kingfisher

github.com/mongodb/kingfisher · GitHub repo · Free

MongoDB's free scanner that finds secrets and checks which still work. Maps what a live key can reach, then revokes supported keys right from the CLI.

Best for: Triage after a leak

2. Betterleaks

github.com/betterleaks/betterleaks · GitHub repo · Free

New secret scanner from the creator of Gitleaks. Reads your existing .gitleaks.toml and takes the same CLI flags. Nothing to rewrite.

Best for: Your first repo scan

3. SupaShield

github.com/Rodrigotari1/supashield · GitHub repo · Free

Tests your Supabase RLS policies before you ship. Your anon key is public by design, so RLS is the only lock.

Best for: Lovable and Supabase apps

4. TruffleHog

github.com/trufflesecurity/trufflehog · GitHub repo · Free

Finds leaked credentials and checks whether they still work. Tells you which leaked keys are live, so you fix the dangerous ones first.

Best for: Sorting live keys from dead ones

5. GitHub push protection

docs.github.com/en/code-security/secret-scanning/working-with-secret-scanning-and-push-protection/push-protection-for-users · Docs · Free

Blocks a push to a public repo if it spots a known type of secret. It's free and on by default. Don't click bypass unless you're sure the secret is fake.

Best for: Public repos on GitHub

6. git-secrets

github.com/awslabs/git-secrets · GitHub repo · Free

AWS Labs' git hook that blocks commits containing secrets. Stops the leak before it happens instead of cleaning up after.

Best for: Blocking commits on your laptop

7. detect-secrets

github.com/Yelp/detect-secrets · GitHub repo · Free

Yelp's secret scanner built around a baseline of known findings. Good for old repos: only new secrets fail the check.

Best for: Old repos with known noise

8. GitHub sensitive data removal guide

docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository · Docs · Free

GitHub's official steps to scrub a secret from git history. Rotate the key first. Then the guide walks you through git-filter-repo to clear it from every branch.

Best for: Cleaning up after a leak

Before you ship it, or buy it

Most of these tools look at one problem at a time. git11 reads the whole repository and gives it a grade from A to F, with every finding pinned to a file and line. Scan a repo free.