Scanning happens in your browser, which is the only reason it is reasonable to paste a private diff into a web page at all. Load the page, disconnect, and the scan still runs.
What to scan
A staged diff, before you commit. git diff --cached | pbcopy and paste. This is the highest-value moment — the one point where a leak is still fully preventable.
A log excerpt. Credentials end up in logs through error handlers that dump request headers, debug statements, and stack traces that include configuration objects.
A config file you are about to share, attach to a ticket, or hand to a contractor.
A paste you found. If a credential has appeared somewhere public, identifying which one and what it grants is the first step of the response.
Reading the findings
Each finding carries a severity that reflects what the credential does, not how confidently it was matched:
- Critical — full account access, money movement, code deployment, or the ability to read other secrets. Rotate now.
- High — significant scoped access. Rotate today.
- Medium — limited access, or a value that needs human judgement.
- Low — informational, or a value that is often public by design.
Findings are sorted by severity, then line number, so the top of the list is the work.
Confidence and false positives
High-confidence signatures are anchored and length-bounded: sk_live_[0-9a-zA-Z]{24,247} will not match a commit SHA. Shape-only patterns — "40 hex characters", "a 40-character Base64 string" — are marked low confidence and excluded by default.
Turning them on catches unprefixed credentials such as AWS secret access keys, at the cost of firing on hashes, IDs and checksums. That trade is worth making for a one-off investigation and not worth making in CI, where a noisy scanner trains everyone to ignore it.
After a finding
The order matters more than people expect:
- Revoke. Not investigate — revoke. A committed key is compromised from the moment it was pushed, and revocation takes seconds while investigation takes hours.
- Replace and deploy.
- Read the audit log for the key's whole validity window, not just today.
- Purge from history with
git filter-repo. This does not undo the exposure; rotation did that. It stops the next person finding it. - Add prevention — a pre-commit hook and CI scanning, so it is caught earlier next time.
Frequently asked questions
Is my code uploaded?
No. The scan runs entirely in your browser against a bundled pattern library. Nothing is transmitted, which is what makes it safe to paste a private diff.
Why did it not find my AWS secret access key?
An AWS secret key is 40 characters of Base64-ish text with no prefix — indistinguishable from a hash or a random ID. It is matched only when it appears near contextual words like aws or secret, or with low-confidence patterns enabled.
Can this replace GitGuardian or TruffleHog?
No, and it is not trying to. Those tools scan entire repository histories continuously and, crucially, validate whether found credentials are still live. This is for the moment you have a specific diff or file in front of you and want an immediate, private answer.
How do I stop leaks rather than find them?
Install a pre-commit hook that blocks credential filenames and greps the staged diff — the gitignore generator emits one — and add a CI scanner that fails the build. Prevention at commit time is worth more than detection at review time.