00:00since you opened this page

A leaked key can be in use within 5 minutes. Be faster.

Spillkit is a free, open-source kit for engineering teams. It blocks secrets at the commit, finds every one already in your Git history, tells you what to rotate first, tracks down copies that survive deletion and writes the report your leadership needs.

Install free Get the 15-minute plan

MIT licence · Signed releases · Linux and macOS · Version 3.8.1

.envpublic

DATABASE_URL=

AWS_ACCESS_KEY_ID=

AWS_SECRET_ACCESS_KEY=

STRIPE_API_KEY=

Committed 14:02 UTC · values redacted

$ leak scan payments-api
2 findings, secret values redacted
RULE                 FILE    COMMIT
aws-access-token     .env:2  a41f9c2
stripe-access-token  .env:4  a41f9c2
Next: leak plan secrets-report.json

100%of your Git history scanned: every commit on every branch, including secrets that were deleted later.
11checks for copies that survive deletion: forks, archives, mirrors and code search, in one command.
9 of 9secret types blocked at the commit in our test. GitHub push protection alone blocked 5.
0secret values printed, logged or sent anywhere. Reports show types and counts only.

One kit for before, during and after a leak

Tested configs, step-by-step runbooks and a single command, leak, that does the slow parts for you.

Block it at the commit

Hooks stop .env files, keys and secrets before they are committed. CI templates catch whatever slips through.

Prevention kit

Find every secret in history

Scan every commit on every branch, including secrets someone already deleted. Values are always redacted.

leak scan

Rotate in the right order

A plan from the scan, most dangerous first, with where to revoke each secret. Cloud keys and GitLab and Azure DevOps tokens are rotated step by step, the new one piped straight into your vault.

leak plan and leak rotate

Brief leadership the same day

Turn the evidence into a print-ready report with the facts leadership needs to decide, and none of the secrets.

leak report

Deleting the repository doesn't delete the leak.

Forks, mirrors and web archives keep copies long after the original is gone. leak hunt checks them all at once and saves every answer as evidence.

When a service is down or rate-limited, it says not checked and exits with code 4. It never guesses "clean".

Copy found
Clean
Not checked

Where copies survive

Direct forks: copy found
Same-name forks: clean
Wayback Machine: copy found
Software Heritage: copy found
GitLab: clean
Code search: not checked
Public gists: clean
Public activity: copy found
Other repositories: clean

Illustration of a leak hunt result.

From the terminal to the boardroom

Everything below was produced by the toolkit on demo repositories.

The audit-org dashboard: five repositories graded from A to F, a grade distribution and the fixes each one needs

For platform and security teams

Know where every repository stands

leak audit-org grades every repository from A to F and lists the exact fix for each gap, worst first.

Tracked secret files, ignore rules, hooks, CI and container builds
HTML for people, Markdown and JSON for automation
Repositories it could not read are marked, never hidden

The leadership report generated by leak report: executive summary, status cards and key facts

For leadership

A report they can act on

leak report turns the hunt and the scan into a print-ready summary: what leaked, for how long, what was found and what happens next.

Secret types and counts, never values
Every check backed by saved evidence and a checksum
Facts only a person knows are highlighted to fill in

When it happens, open this.

The first quarter of an hour decides how much a leak costs. The plan fits on one page, so nobody has to work out the order under pressure.

Open the cheat sheet Rehearse in 45 minutes

If a secret has leaked

The first 15 minutes

0–2 min
Say it out loud. Tell your lead or security channel, then start the record: a UTC timeline, with the read-only steps below run in order.
leak respond owner/repo
2–5 min
Keep the evidence. If the copy is yours and public by mistake, make it private. Don't delete it yet.
leak snapshot owner/repo
5–10 min
Rotate the most powerful secret first. Revoke the old value; adding a new one is not enough.
leak rotate aws-key
10–15 min
Scan the whole history for every other secret, then put them in order.
leak scan ./repo && leak plan
Then
Remove copies, check the logs, notify.
leak hunt owner/repo

A security tool you can check

You will run it during an incident, so every claim on this page can be verified.

Signed releases
Archives and images signed with Sigstore, with an SBOM and SLSA provenance. Verify one
Fails closed
A scanner error or an unreachable source is reported as not checked, never as clean.
Secrets stay private
No command prints or tests a secret. Tokens never appear in process lists or logs.
Independently scored
OpenSSF Scorecard, CodeQL and 60 tests on Linux and macOS for every change. See the score

Install in a minute

One line on Linux and macOS, checked against the signed release, or Homebrew. Or run the signed container image, or add the toolkit to your pipeline and commit hooks.

Works with

GitHub
GitLab
Bitbucket
Azure DevOps
AWS
Azure
Google Cloud
Docker
pre-commit
gitleaks

# No root. Verifies the SHA-256, and the signature if cosign is installed.
curl -fsSL https://github.com/aboutBilal/spillkit/releases/latest/download/install.sh \
  | bash
leak demo   # see it work in a minute, on a leak made for the purpose

# macOS and Linux. Brings gitleaks, jq and, on macOS, a current bash.
brew install aboutbilal/tap/spillkit
leak demo   # see it work in a minute, on a leak made for the purpose

# No local dependencies. Signed image for amd64 and arm64.
docker run --rm -v "$PWD:/repo" ghcr.io/aboutbilal/spillkit audit /repo
docker run --rm -v "$PWD:/repo" ghcr.io/aboutbilal/spillkit scan /repo

# Needs bash 4.4+, git, curl, jq, and gitleaks or Docker.
git clone https://github.com/aboutBilal/spillkit.git
cd spillkit && make install
leak doctor
leak audit .

# .github/workflows/secrets.yml
on: [push, pull_request]
permissions:
  contents: read
jobs:
  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { fetch-depth: 0, persist-credentials: false }
      - uses: aboutBilal/spillkit@v3.8.1   # pin to a commit SHA in production
        with:
          mode: scan   # scan, audit, audit-org or hunt

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/aboutBilal/spillkit
    rev: v3.8.1
    hooks:
      - id: forbid-secret-files   # blocks .env, keys, state files
      - id: leak-guard            # also scans staged changes with gitleaks

Questions teams ask first

Does it send my code or secrets anywhere?: No. scan, audit and plan run entirely on your machine, and rotate uses your own cloud CLI, or the GitLab API, only for the steps you apply. hunt and audit-org send only repository names, account names and commit IDs to public services.
Why doesn't it test whether a leaked key still works?: Using a leaked credential is what an attacker does, and it can trigger alarms or break a provider's terms. The answer is the same either way: rotate it.
Does it work outside GitHub?: Yes. Scanning, auditing, the hooks and the CI templates work with any Git repository on GitHub, GitLab, Azure DevOps or Bitbucket, and audit-org grades whole organisations on all four.
How does it compare with gitleaks or TruffleHog?: Detection comes from gitleaks. The toolkit adds grading, rotation plans and guided rotation, runbooks, the hunt for copies and the leadership report. See the comparison.
Can my company use and change it?: Yes. It is MIT-licensed. Adapt the runbooks to your organisation and ship the prevention kit in your repository templates.
Where do I get help?: Ask in Discussions. Report vulnerabilities privately, as described in the security policy.

You've been here 00:00.

In a real leak, that's long enough for someone to find a key. Set the toolkit up before you need it.

Install free View on GitHub