Skip to main content
POST
GitHub Leaks

Overview

GitHub Leaks scans a public repository for exposed secrets - API keys, tokens, private keys, and other credentials committed to the code. It returns each finding with its location, a masked preview, a severity, and a stable fingerprint, so you can triage and track leaks over time. Billing is outcome-based: you pay 1 credit per leak found. A clean scan, a refused scan, and a repeat of a repository state you already paid for are all free. Scan synchronously and read the findings in the response, or run a background scan for large repositories and read the result when it finishes.

Authentication

Requires an API key in the Authorization header.

Request

string
required
The repository to scan. Must be an https URL on an allowlisted host (e.g. https://github.com/org/repo), with no embedded credentials.
integer
default:"0"
Detection profile: 0 (default) runs the standard detector, 1 runs the alternate detector, 2 runs both in parallel and merges findings by location.
object
Optional scan tuning.

Example request

Response

Returns the {success, result, message} envelope. A scan with zero findings is a success, not an error.
boolean
Whether the scan completed.
string
A sentence written for your end user.
object
The scan outcome.

Read a stored scan

Re-read any scan by its id. Useful after a background scan, or to re-filter findings without paying again.
string
Filter the stored findings by minimum severity (critical, high, medium, low). This filters what is returned - it never re-scans and never charges again.

Background scans

Set config.run_at_background: true (or config.deep_scan: true, which forces it) and the request returns 202 with status: "processing" and a scan_id, before the scan finishes. When it completes, the findings are stored and a realtime event is pushed - see Webhooks & events. Read the finished result from GET /api/lookup/breaches/github/{id}.

Errors

Credits

You pay 1 credit per leak found. A clean scan (zero leaks), a refused or failed scan, and a repeat of a repository state and configuration you already paid for are all free. See Credits.