GitHub Leaks

curl -X POST "https://developer.encrata.com/api/lookup/breaches/github" \
  -H "Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"repo": "https://github.com/org/repo"}'

import requests

resp = requests.post(
    "https://developer.encrata.com/api/lookup/breaches/github",
    headers={"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"},
    json={"repo": "https://github.com/org/repo"},
)
print(resp.json())

const resp = await fetch("https://developer.encrata.com/api/lookup/breaches/github", {
  method: "POST",
  headers: {
    Authorization: "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ repo: "https://github.com/org/repo" }),
});
const data = await resp.json();

{
  "success": true,
  "result": {
    "scan_id": "d4e5f6a1-7b8c-4d9e-8f10-1a2b3c4d5e6f",
    "repository_id": "3f8c1a22-9e41-4b0d-8d77-5a6b7c8d9e01",
    "target": "https://github.com/org/repo",
    "kind": "github",
    "type": 0,
    "status": "processing",
    "credits": 0
  },
  "message": "Scan started. We'll notify you when it's ready."
}

{
  "success": true,
  "result": {
    "scan_id": "6f1c2e94-2b6a-4a1e-9b3a-6c9f0f2a1d77",
    "repository_id": "3f8c1a22-9e41-4b0d-8d77-5a6b7c8d9e01",
    "target": "https://github.com/org/repo",
    "kind": "github",
    "type": 0,
    "commit_sha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
    "status": "succeeded",
    "findings": [
      {
        "fingerprint": "b9d1...e2",
        "rule_id": "aws-access-key-id",
        "description": "AWS Access Key",
        "severity": "high",
        "severity_source": "rule",
        "engines": ["gitleaks"],
        "file": "config/prod.env",
        "start_line": 12,
        "end_line": 12,
        "column": 19,
        "entropy": 4.21,
        "tags": ["aws", "cloud"],
        "preview": "AKIA****************",
        "commit": "a1b2c3d",
        "author": "Jane Dev",
        "email": "jane@example.com",
        "date": "2026-02-11T09:14:00Z",
        "likely_false_positive": false
      }
    ],
    "summary": {
      "total": 1,
      "by_severity": { "high": 1 },
      "by_engine": { "gitleaks": 1 },
      "engines_run": ["gitleaks"],
      "head_sha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
      "deep_scan": true,
      "duration_ms": 1840,
      "suppressed": 0,
      "truncated": false
    },
    "reused": false,
    "charged": true,
    "credits": 1
  },
  "message": "Found 1 leaked secret in this repository."
}

{
  "success": true,
  "result": {
    "scan_id": "0a7b9c11-4d22-4e88-9a10-2b3c4d5e6f70",
    "repository_id": "3f8c1a22-9e41-4b0d-8d77-5a6b7c8d9e01",
    "target": "https://github.com/org/repo",
    "kind": "github",
    "type": 0,
    "status": "succeeded",
    "findings": [],
    "summary": {
      "total": 0,
      "by_severity": {},
      "by_engine": {},
      "engines_run": ["gitleaks"],
      "deep_scan": true,
      "duration_ms": 900,
      "suppressed": 0,
      "truncated": false
    },
    "reused": false,
    "charged": false,
    "credits": 0
  },
  "message": "No leaked secrets were found in this repository."
}

{
  "success": false,
  "result": { "code": "validation_failed" },
  "message": "repo must be a github.com repository URL."
}

POST

api

lookup

breaches

github

curl -X POST "https://developer.encrata.com/api/lookup/breaches/github" \
  -H "Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"repo": "https://github.com/org/repo"}'

import requests

resp = requests.post(
    "https://developer.encrata.com/api/lookup/breaches/github",
    headers={"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"},
    json={"repo": "https://github.com/org/repo"},
)
print(resp.json())

const resp = await fetch("https://developer.encrata.com/api/lookup/breaches/github", {
  method: "POST",
  headers: {
    Authorization: "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ repo: "https://github.com/org/repo" }),
});
const data = await resp.json();

{
  "success": true,
  "result": {
    "scan_id": "d4e5f6a1-7b8c-4d9e-8f10-1a2b3c4d5e6f",
    "repository_id": "3f8c1a22-9e41-4b0d-8d77-5a6b7c8d9e01",
    "target": "https://github.com/org/repo",
    "kind": "github",
    "type": 0,
    "status": "processing",
    "credits": 0
  },
  "message": "Scan started. We'll notify you when it's ready."
}

{
  "success": true,
  "result": {
    "scan_id": "6f1c2e94-2b6a-4a1e-9b3a-6c9f0f2a1d77",
    "repository_id": "3f8c1a22-9e41-4b0d-8d77-5a6b7c8d9e01",
    "target": "https://github.com/org/repo",
    "kind": "github",
    "type": 0,
    "commit_sha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
    "status": "succeeded",
    "findings": [
      {
        "fingerprint": "b9d1...e2",
        "rule_id": "aws-access-key-id",
        "description": "AWS Access Key",
        "severity": "high",
        "severity_source": "rule",
        "engines": ["gitleaks"],
        "file": "config/prod.env",
        "start_line": 12,
        "end_line": 12,
        "column": 19,
        "entropy": 4.21,
        "tags": ["aws", "cloud"],
        "preview": "AKIA****************",
        "commit": "a1b2c3d",
        "author": "Jane Dev",
        "email": "jane@example.com",
        "date": "2026-02-11T09:14:00Z",
        "likely_false_positive": false
      }
    ],
    "summary": {
      "total": 1,
      "by_severity": { "high": 1 },
      "by_engine": { "gitleaks": 1 },
      "engines_run": ["gitleaks"],
      "head_sha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
      "deep_scan": true,
      "duration_ms": 1840,
      "suppressed": 0,
      "truncated": false
    },
    "reused": false,
    "charged": true,
    "credits": 1
  },
  "message": "Found 1 leaked secret in this repository."
}

{
  "success": true,
  "result": {
    "scan_id": "0a7b9c11-4d22-4e88-9a10-2b3c4d5e6f70",
    "repository_id": "3f8c1a22-9e41-4b0d-8d77-5a6b7c8d9e01",
    "target": "https://github.com/org/repo",
    "kind": "github",
    "type": 0,
    "status": "succeeded",
    "findings": [],
    "summary": {
      "total": 0,
      "by_severity": {},
      "by_engine": {},
      "engines_run": ["gitleaks"],
      "deep_scan": true,
      "duration_ms": 900,
      "suppressed": 0,
      "truncated": false
    },
    "reused": false,
    "charged": false,
    "credits": 0
  },
  "message": "No leaked secrets were found in this repository."
}

{
  "success": false,
  "result": { "code": "validation_failed" },
  "message": "repo must be a github.com repository URL."
}

Overview

GitHub Leaks scans a public repository for exposed secrets - API keys, tokens, private keys, and other credentials committed to the code. It returns each finding with its location, a masked preview, a severity, and a stable fingerprint, so you can triage and track leaks over time. Billing is outcome-based: you pay 1 credit per leak found. A clean scan, a refused scan, and a repeat of a repository state you already paid for are all free.

Scanning is always asynchronous. A new scan returns 202 with status: "processing", then you poll GET /api/lookup/breaches/github/{scan_id} for the findings. Only a request that reuses an already-completed scan of the same repository state returns 200 with findings inline. See Run a scan.

Authentication

Requires an API key in the Authorization header.

Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Request

string

required

The repository to scan. Must be an https://github.com/... repository URL with no embedded credentials.

integer

default:"0"

Detection profile: 0 (default) runs the standard detector, 1 runs the alternate detector, 2 runs both in parallel and merges findings by location.

object

Optional scan tuning.

Show config

string

Drop findings below this floor: critical, high, medium, or low.

string[]

Restrict detection to specific rule ids. Empty runs every rule.

integer

default:"1000"

Cap the number of findings returned.

string[]

Fingerprints to suppress - known findings you have already triaged.

boolean

Include findings flagged as likely false positives.

string

A specific branch, tag, or commit to scan.

integer

Bound a history scan to the most recent N commits (1-10). Mutually exclusive with deep_scan. Because this endpoint always runs a deep scan, sending depth fails validation with 422.

boolean

default:"true"

Scan the full commit history. Always forced to true on this endpoint; you cannot turn it off.

boolean

default:"true"

Effectively always on, because deep_scan forces it.

Example request

curl -X POST "https://developer.encrata.com/api/lookup/breaches/github" \
  -H "Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"repo": "https://github.com/org/repo"}'

import requests

resp = requests.post(
    "https://developer.encrata.com/api/lookup/breaches/github",
    headers={"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"},
    json={"repo": "https://github.com/org/repo"},
)
print(resp.json())

const resp = await fetch("https://developer.encrata.com/api/lookup/breaches/github", {
  method: "POST",
  headers: {
    Authorization: "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ repo: "https://github.com/org/repo" }),
});
const data = await resp.json();

Response

Returns the {success, result, message} envelope. A scan with zero findings is a success, not an error.

boolean

Whether the request was accepted.

string

A sentence written for your end user.

object

The scan outcome.

Show result

string

The scan’s id. Poll GET /api/lookup/breaches/github/{scan_id} with it.

string

Encrata’s stable id for the scanned repository.

string

The normalised repository URL that was scanned.

string

The scan family (e.g. github).

integer

The detection profile that ran (0, 1, or 2).

integer

The history depth that was applied.

object

The effective configuration the scan ran with, after defaults are applied.

string

The repository state these findings describe.

string

processing (the scan is still running - poll for the result), succeeded (findings are in this response), or failed.

object[]

The detected secrets. Each finding never contains the raw credential. Empty while status is processing.

Show finding

string

Stable identifier for this finding, derived from a hash of the match. Use it to deduplicate and to build a baseline.

string

The detection rule that matched (e.g. aws-access-key-id).

string

Human-readable description of what was found.

string

critical, high, medium, low, or unknown.

string

Where the severity came from (the rule, or an engine override).

string[]

The detection engines that produced this finding.

string

Path to the file containing the secret.

integer

1-based line where the match starts.

integer

1-based line where the match ends.

integer

1-based column of the match on start_line.

number

Shannon entropy of the matched string. Higher means more secret-looking.

string[]

Rule tags, for your own triage routing.

string

A masked preview of the match (e.g. AKIA****************). The raw secret is never returned.

string

The commit SHA the secret was found in. A string, not an object. The author, email, and date strings sit beside it on the finding.

string

Commit author name, when available.

string

Commit author email, when available.

string

Commit timestamp, when available.

boolean

Whether this finding is flagged as a likely false positive.

object

Roll-up of the scan: total, by_severity, by_engine, engines_run, rules_requested, head_sha, deep_scan, duration_ms, suppressed (dropped by a filter or baseline), and truncated.

boolean

An existing scan of this repository state answered the request, so no new scan ran. This is the only case that returns findings with 200.

boolean

Whether this request debited the account. false on a clean scan, or when the account already paid for this repository state and configuration.

integer

Credits debited: one per leak found, or 0 when the scan was clean or already paid for. Always 0 on a 202, because nothing is settled yet.

Run a scan

Start the scan

POST /api/lookup/breaches/github returns 202 with a scan_id and status: "processing". If an identical scan of the same repository state already completed, you get 200 with the findings inline and reused: true.

Poll for the result

Call GET /api/lookup/breaches/github/{scan_id} until status is succeeded or failed. Re-reads never re-scan and never charge again.

curl "https://developer.encrata.com/api/lookup/breaches/github/{scan_id}?min_severity=high" \
  -H "Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Triage the findings

Store each fingerprint and pass known ones back as config.baseline_fingerprints on the next scan to suppress them.

string

Filter the stored findings by minimum severity (critical, high, medium, low). This filters what is returned - it never re-scans and never charges again.

Completion also pushes a realtime event. See Webhooks & events.

Errors

Errors use the same envelope: {"success": false, "result": {"code": "..."}, "message": "..."}.

Status	Cause
`400`	Unreadable JSON body
`401`	Missing or invalid API key
`402`	Insufficient credits. The service requires at least 1 available credit before it will start a scan, even though a clean scan settles at 0
`404`	The repository doesn’t exist or isn’t public
`422`	`repo` missing, not a `github.com` repository URL, or `depth` was sent alongside the forced `deep_scan`
`429`	All concurrent scan slots are busy. This is a parallelism cap, not a requests-per-minute limit - retry once a running scan finishes
`500`	Unexpected server failure
`502`	The repository could not be cloned or scanned
`503`	The scanning service is not available
`504`	The scan exceeded its time limit

Credits

You pay 1 credit per leak found. A clean scan (zero leaks), a refused or failed scan, and a repeat of a repository state and configuration you already paid for are all free. Settlement happens when the scan completes, so a 202 always reports credits: 0. See Credits.

curl -X POST "https://developer.encrata.com/api/lookup/breaches/github" \
  -H "Authorization: Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"repo": "https://github.com/org/repo"}'

import requests

resp = requests.post(
    "https://developer.encrata.com/api/lookup/breaches/github",
    headers={"Authorization": "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"},
    json={"repo": "https://github.com/org/repo"},
)
print(resp.json())

const resp = await fetch("https://developer.encrata.com/api/lookup/breaches/github", {
  method: "POST",
  headers: {
    Authorization: "Bearer enc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ repo: "https://github.com/org/repo" }),
});
const data = await resp.json();

{
  "success": true,
  "result": {
    "scan_id": "d4e5f6a1-7b8c-4d9e-8f10-1a2b3c4d5e6f",
    "repository_id": "3f8c1a22-9e41-4b0d-8d77-5a6b7c8d9e01",
    "target": "https://github.com/org/repo",
    "kind": "github",
    "type": 0,
    "status": "processing",
    "credits": 0
  },
  "message": "Scan started. We'll notify you when it's ready."
}

{
  "success": true,
  "result": {
    "scan_id": "6f1c2e94-2b6a-4a1e-9b3a-6c9f0f2a1d77",
    "repository_id": "3f8c1a22-9e41-4b0d-8d77-5a6b7c8d9e01",
    "target": "https://github.com/org/repo",
    "kind": "github",
    "type": 0,
    "commit_sha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
    "status": "succeeded",
    "findings": [
      {
        "fingerprint": "b9d1...e2",
        "rule_id": "aws-access-key-id",
        "description": "AWS Access Key",
        "severity": "high",
        "severity_source": "rule",
        "engines": ["gitleaks"],
        "file": "config/prod.env",
        "start_line": 12,
        "end_line": 12,
        "column": 19,
        "entropy": 4.21,
        "tags": ["aws", "cloud"],
        "preview": "AKIA****************",
        "commit": "a1b2c3d",
        "author": "Jane Dev",
        "email": "jane@example.com",
        "date": "2026-02-11T09:14:00Z",
        "likely_false_positive": false
      }
    ],
    "summary": {
      "total": 1,
      "by_severity": { "high": 1 },
      "by_engine": { "gitleaks": 1 },
      "engines_run": ["gitleaks"],
      "head_sha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
      "deep_scan": true,
      "duration_ms": 1840,
      "suppressed": 0,
      "truncated": false
    },
    "reused": false,
    "charged": true,
    "credits": 1
  },
  "message": "Found 1 leaked secret in this repository."
}

{
  "success": true,
  "result": {
    "scan_id": "0a7b9c11-4d22-4e88-9a10-2b3c4d5e6f70",
    "repository_id": "3f8c1a22-9e41-4b0d-8d77-5a6b7c8d9e01",
    "target": "https://github.com/org/repo",
    "kind": "github",
    "type": 0,
    "status": "succeeded",
    "findings": [],
    "summary": {
      "total": 0,
      "by_severity": {},
      "by_engine": {},
      "engines_run": ["gitleaks"],
      "deep_scan": true,
      "duration_ms": 900,
      "suppressed": 0,
      "truncated": false
    },
    "reused": false,
    "charged": false,
    "credits": 0
  },
  "message": "No leaked secrets were found in this repository."
}

{
  "success": false,
  "result": { "code": "validation_failed" },
  "message": "repo must be a github.com repository URL."
}

Known issue: Public repositories, including https://github.com/octocat/Hello-World, can return 404 with the message That repository doesn't exist or isn't public. Check the URL and try again.

Overview

Email

Breaches

Malware

API Keys

Webhooks

Account

Overview

Authentication

Request

Example request

Response

Run a scan

Errors

Credits

​Overview

​Authentication

​Request

​Example request

​Response

​Run a scan

​Errors

​Credits

Overview

Authentication

Request

Example request

Response

Run a scan

Errors

Credits