GitHub Leaks
curl --request POST \
--url https://developer.encrata.com/api/lookup/breaches/github \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"repo": "<string>",
"type": 123,
"config": {
"deep_scan": true,
"run_at_background": true,
"min_severity": "<string>",
"rules": [
"<string>"
],
"max_findings": 123,
"depth": 123,
"baseline_fingerprints": [
"<string>"
],
"include_likely_false_positives": true,
"ref": "<string>"
}
}
'import requests
url = "https://developer.encrata.com/api/lookup/breaches/github"
payload = {
"repo": "<string>",
"type": 123,
"config": {
"deep_scan": True,
"run_at_background": True,
"min_severity": "<string>",
"rules": ["<string>"],
"max_findings": 123,
"depth": 123,
"baseline_fingerprints": ["<string>"],
"include_likely_false_positives": True,
"ref": "<string>"
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
repo: '<string>',
type: 123,
config: {
deep_scan: true,
run_at_background: true,
min_severity: '<string>',
rules: ['<string>'],
max_findings: 123,
depth: 123,
baseline_fingerprints: ['<string>'],
include_likely_false_positives: true,
ref: '<string>'
}
})
};
fetch('https://developer.encrata.com/api/lookup/breaches/github', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://developer.encrata.com/api/lookup/breaches/github",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'repo' => '<string>',
'type' => 123,
'config' => [
'deep_scan' => true,
'run_at_background' => true,
'min_severity' => '<string>',
'rules' => [
'<string>'
],
'max_findings' => 123,
'depth' => 123,
'baseline_fingerprints' => [
'<string>'
],
'include_likely_false_positives' => true,
'ref' => '<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://developer.encrata.com/api/lookup/breaches/github"
payload := strings.NewReader("{\n \"repo\": \"<string>\",\n \"type\": 123,\n \"config\": {\n \"deep_scan\": true,\n \"run_at_background\": true,\n \"min_severity\": \"<string>\",\n \"rules\": [\n \"<string>\"\n ],\n \"max_findings\": 123,\n \"depth\": 123,\n \"baseline_fingerprints\": [\n \"<string>\"\n ],\n \"include_likely_false_positives\": true,\n \"ref\": \"<string>\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://developer.encrata.com/api/lookup/breaches/github")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"repo\": \"<string>\",\n \"type\": 123,\n \"config\": {\n \"deep_scan\": true,\n \"run_at_background\": true,\n \"min_severity\": \"<string>\",\n \"rules\": [\n \"<string>\"\n ],\n \"max_findings\": 123,\n \"depth\": 123,\n \"baseline_fingerprints\": [\n \"<string>\"\n ],\n \"include_likely_false_positives\": true,\n \"ref\": \"<string>\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://developer.encrata.com/api/lookup/breaches/github")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"repo\": \"<string>\",\n \"type\": 123,\n \"config\": {\n \"deep_scan\": true,\n \"run_at_background\": true,\n \"min_severity\": \"<string>\",\n \"rules\": [\n \"<string>\"\n ],\n \"max_findings\": 123,\n \"depth\": 123,\n \"baseline_fingerprints\": [\n \"<string>\"\n ],\n \"include_likely_false_positives\": true,\n \"ref\": \"<string>\"\n }\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"result": {
"scan_id": "6f1c2e94-2b6a-4a1e-9b3a-6c9f0f2a1d77",
"target": "https://github.com/org/repo",
"commit_sha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
"status": "succeeded",
"findings": [
{
"fingerprint": "b9d1...e2",
"rule_id": "aws-access-key-id",
"description": "AWS Access Key",
"severity": "high",
"file": "config/prod.env",
"start_line": 12,
"preview": "AKIA****************",
"commit": "a1b2c3d",
"author": "Jane Dev",
"email": "jane@example.com",
"date": "2026-02-11T09:14:00Z",
"likely_false_positive": false
}
],
"summary": {
"total": 1,
"by_severity": { "high": 1 },
"deep_scan": false,
"duration_ms": 1840,
"suppressed": 0,
"truncated": false
},
"reused": false,
"charged": true,
"credits": 1
},
"message": "Found 1 leaked secret in this repository."
}
{
"success": true,
"result": {
"scan_id": "0a7b9c11-4d22-4e88-9a10-2b3c4d5e6f70",
"target": "https://github.com/org/repo",
"status": "succeeded",
"findings": [],
"summary": { "total": 0, "by_severity": {}, "deep_scan": false, "duration_ms": 900, "suppressed": 0, "truncated": false },
"reused": false,
"charged": false,
"credits": 0
},
"message": "No leaked secrets were found in this repository."
}
{
"success": true,
"result": {
"scan_id": "d4e5f6a1-7b8c-4d9e-8f10-1a2b3c4d5e6f",
"target": "https://github.com/org/repo",
"status": "processing"
},
"message": "Scan started. We'll notify you when it's ready."
}
Breaches
GitHub Leaks
Scan a public GitHub repository for leaked secrets. 1 credit per leak found - a clean scan is free.
POST
/
api
/
lookup
/
breaches
/
github
GitHub Leaks
curl --request POST \
--url https://developer.encrata.com/api/lookup/breaches/github \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"repo": "<string>",
"type": 123,
"config": {
"deep_scan": true,
"run_at_background": true,
"min_severity": "<string>",
"rules": [
"<string>"
],
"max_findings": 123,
"depth": 123,
"baseline_fingerprints": [
"<string>"
],
"include_likely_false_positives": true,
"ref": "<string>"
}
}
'import requests
url = "https://developer.encrata.com/api/lookup/breaches/github"
payload = {
"repo": "<string>",
"type": 123,
"config": {
"deep_scan": True,
"run_at_background": True,
"min_severity": "<string>",
"rules": ["<string>"],
"max_findings": 123,
"depth": 123,
"baseline_fingerprints": ["<string>"],
"include_likely_false_positives": True,
"ref": "<string>"
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
repo: '<string>',
type: 123,
config: {
deep_scan: true,
run_at_background: true,
min_severity: '<string>',
rules: ['<string>'],
max_findings: 123,
depth: 123,
baseline_fingerprints: ['<string>'],
include_likely_false_positives: true,
ref: '<string>'
}
})
};
fetch('https://developer.encrata.com/api/lookup/breaches/github', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://developer.encrata.com/api/lookup/breaches/github",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'repo' => '<string>',
'type' => 123,
'config' => [
'deep_scan' => true,
'run_at_background' => true,
'min_severity' => '<string>',
'rules' => [
'<string>'
],
'max_findings' => 123,
'depth' => 123,
'baseline_fingerprints' => [
'<string>'
],
'include_likely_false_positives' => true,
'ref' => '<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://developer.encrata.com/api/lookup/breaches/github"
payload := strings.NewReader("{\n \"repo\": \"<string>\",\n \"type\": 123,\n \"config\": {\n \"deep_scan\": true,\n \"run_at_background\": true,\n \"min_severity\": \"<string>\",\n \"rules\": [\n \"<string>\"\n ],\n \"max_findings\": 123,\n \"depth\": 123,\n \"baseline_fingerprints\": [\n \"<string>\"\n ],\n \"include_likely_false_positives\": true,\n \"ref\": \"<string>\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://developer.encrata.com/api/lookup/breaches/github")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"repo\": \"<string>\",\n \"type\": 123,\n \"config\": {\n \"deep_scan\": true,\n \"run_at_background\": true,\n \"min_severity\": \"<string>\",\n \"rules\": [\n \"<string>\"\n ],\n \"max_findings\": 123,\n \"depth\": 123,\n \"baseline_fingerprints\": [\n \"<string>\"\n ],\n \"include_likely_false_positives\": true,\n \"ref\": \"<string>\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://developer.encrata.com/api/lookup/breaches/github")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"repo\": \"<string>\",\n \"type\": 123,\n \"config\": {\n \"deep_scan\": true,\n \"run_at_background\": true,\n \"min_severity\": \"<string>\",\n \"rules\": [\n \"<string>\"\n ],\n \"max_findings\": 123,\n \"depth\": 123,\n \"baseline_fingerprints\": [\n \"<string>\"\n ],\n \"include_likely_false_positives\": true,\n \"ref\": \"<string>\"\n }\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"result": {
"scan_id": "6f1c2e94-2b6a-4a1e-9b3a-6c9f0f2a1d77",
"target": "https://github.com/org/repo",
"commit_sha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
"status": "succeeded",
"findings": [
{
"fingerprint": "b9d1...e2",
"rule_id": "aws-access-key-id",
"description": "AWS Access Key",
"severity": "high",
"file": "config/prod.env",
"start_line": 12,
"preview": "AKIA****************",
"commit": "a1b2c3d",
"author": "Jane Dev",
"email": "jane@example.com",
"date": "2026-02-11T09:14:00Z",
"likely_false_positive": false
}
],
"summary": {
"total": 1,
"by_severity": { "high": 1 },
"deep_scan": false,
"duration_ms": 1840,
"suppressed": 0,
"truncated": false
},
"reused": false,
"charged": true,
"credits": 1
},
"message": "Found 1 leaked secret in this repository."
}
{
"success": true,
"result": {
"scan_id": "0a7b9c11-4d22-4e88-9a10-2b3c4d5e6f70",
"target": "https://github.com/org/repo",
"status": "succeeded",
"findings": [],
"summary": { "total": 0, "by_severity": {}, "deep_scan": false, "duration_ms": 900, "suppressed": 0, "truncated": false },
"reused": false,
"charged": false,
"credits": 0
},
"message": "No leaked secrets were found in this repository."
}
{
"success": true,
"result": {
"scan_id": "d4e5f6a1-7b8c-4d9e-8f10-1a2b3c4d5e6f",
"target": "https://github.com/org/repo",
"status": "processing"
},
"message": "Scan started. We'll notify you when it's ready."
}
Overview
GitHub Leaks scans a public repository for exposed secrets - API keys, tokens, private keys, and other credentials committed to the code. It returns each finding with its location, a masked preview, a severity, and a stable fingerprint, so you can triage and track leaks over time. Billing is outcome-based: you pay 1 credit per leak found. A clean scan, a refused scan, and a repeat of a repository state you already paid for are all free. Scan synchronously and read the findings in the response, or run a background scan for large repositories and read the result when it finishes.Authentication
Requires an API key in theAuthorization header.
Authorization: Bearer YOUR_API_KEY
Request
string
required
The repository to scan. Must be an
https URL on an allowlisted host
(e.g. https://github.com/org/repo), with no embedded credentials.integer
default:"0"
Detection profile:
0 (default) runs the standard detector, 1 runs the
alternate detector, 2 runs both in parallel and merges findings by location.object
Optional scan tuning.
Show config
Show config
boolean
default:"false"
Scan the full commit history rather than just the current tree. Forces the
scan to run in the background.
boolean
default:"false"
Run asynchronously - the request returns
202 with status: "processing"
and a scan_id; read the findings later from
GET /api/lookup/breaches/github/{id}.string
Drop findings below this floor:
critical, high, medium, or low.string[]
Restrict detection to specific rule ids. Empty runs every rule.
integer
Cap the number of findings returned.
integer
Bound a history scan to the most recent N commits.
string[]
Fingerprints to suppress - known findings you have already triaged.
boolean
Include findings flagged as likely false positives.
string
A specific branch, tag, or commit to scan.
Example request
curl -X POST "https://developer.encrata.com/api/lookup/breaches/github" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"repo": "https://github.com/org/repo"}'
import requests
resp = requests.post(
"https://developer.encrata.com/api/lookup/breaches/github",
headers={"Authorization": "Bearer YOUR_API_KEY"},
json={"repo": "https://github.com/org/repo"},
)
print(resp.json())
const resp = await fetch("https://developer.encrata.com/api/lookup/breaches/github", {
method: "POST",
headers: {
Authorization: "Bearer YOUR_API_KEY",
"Content-Type": "application/json",
},
body: JSON.stringify({ repo: "https://github.com/org/repo" }),
});
const data = await resp.json();
Response
Returns the{success, result, message} envelope. A scan with zero findings is
a success, not an error.
boolean
Whether the scan completed.
string
A sentence written for your end user.
object
The scan outcome.
Show result
Show result
string
The scan’s id. Use it to re-read the result from
GET /api/lookup/breaches/github/{id}.string
The normalised repository URL that was scanned.
string
The repository state these findings describe.
string
succeeded (findings are in this response), processing (a background
scan is still running), or failed (the scan could not be completed).
Absent on a synchronous scan, which is always complete.object[]
The detected secrets. Each finding never contains the raw credential.
Show finding
Show finding
string
Stable identifier for this finding, derived from a hash of the match.
Use it to deduplicate and to build a baseline.
string
The detection rule that matched (e.g.
aws-access-key-id).string
Human-readable description of what was found.
string
critical, high, medium, low, or unknown.string
Path to the file containing the secret.
integer
1-based line where the match starts. See also
end_line and column.string
A masked preview of the match (e.g.
AKIA****************). The raw
secret is never returned.string
Commit the secret was found in, with
author, email, and date
when available.boolean
Whether this finding is flagged as a likely false positive.
object
Roll-up of the scan:
total, by_severity, rules_requested,
deep_scan, duration_ms, suppressed (dropped by a filter or baseline),
and truncated.boolean
An existing scan of this repository state answered the request, so no new
scan ran.
boolean
Whether this request debited the account.
false on a clean scan, or when
the account already paid for this repository state and configuration.integer
Credits debited: one per leak found, or
0 when the scan was clean or
already paid for.Read a stored scan
Re-read any scan by its id. Useful after a background scan, or to re-filter findings without paying again.curl "https://developer.encrata.com/api/lookup/breaches/github/{scan_id}?min_severity=high" \
-H "Authorization: Bearer YOUR_API_KEY"
string
Filter the stored findings by minimum severity (
critical, high, medium,
low). This filters what is returned - it never re-scans and never charges
again.Background scans
Setconfig.run_at_background: true (or config.deep_scan: true, which forces
it) and the request returns 202 with status: "processing" and a scan_id,
before the scan finishes. When it completes, the findings are stored and a
realtime event is pushed - see Webhooks & events. Read the finished
result from GET /api/lookup/breaches/github/{id}.
Errors
| Status | Cause |
|---|---|
400 | Unreadable JSON body |
402 | Insufficient credits |
404 | The repository doesn’t exist or isn’t public |
422 | repo missing, not https, carries credentials, names an IP, or its host is not allowed |
429 | Too many repository scans are already running |
502 | The repository could not be cloned or scanned |
504 | The scan exceeded its time limit |
Credits
You pay 1 credit per leak found. A clean scan (zero leaks), a refused or failed scan, and a repeat of a repository state and configuration you already paid for are all free. See Credits.{
"success": true,
"result": {
"scan_id": "6f1c2e94-2b6a-4a1e-9b3a-6c9f0f2a1d77",
"target": "https://github.com/org/repo",
"commit_sha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
"status": "succeeded",
"findings": [
{
"fingerprint": "b9d1...e2",
"rule_id": "aws-access-key-id",
"description": "AWS Access Key",
"severity": "high",
"file": "config/prod.env",
"start_line": 12,
"preview": "AKIA****************",
"commit": "a1b2c3d",
"author": "Jane Dev",
"email": "jane@example.com",
"date": "2026-02-11T09:14:00Z",
"likely_false_positive": false
}
],
"summary": {
"total": 1,
"by_severity": { "high": 1 },
"deep_scan": false,
"duration_ms": 1840,
"suppressed": 0,
"truncated": false
},
"reused": false,
"charged": true,
"credits": 1
},
"message": "Found 1 leaked secret in this repository."
}
{
"success": true,
"result": {
"scan_id": "0a7b9c11-4d22-4e88-9a10-2b3c4d5e6f70",
"target": "https://github.com/org/repo",
"status": "succeeded",
"findings": [],
"summary": { "total": 0, "by_severity": {}, "deep_scan": false, "duration_ms": 900, "suppressed": 0, "truncated": false },
"reused": false,
"charged": false,
"credits": 0
},
"message": "No leaked secrets were found in this repository."
}
{
"success": true,
"result": {
"scan_id": "d4e5f6a1-7b8c-4d9e-8f10-1a2b3c4d5e6f",
"target": "https://github.com/org/repo",
"status": "processing"
},
"message": "Scan started. We'll notify you when it's ready."
}
Was this page helpful?