Indie
For solo builders shipping AI apps.
$29/month
Join waitlist- 10 repos monitored
- Railway and Vercel
- Spend alerts for 2 providers
- Slack and email alerts
NewBreach alerts for the platforms you deploy onYour AI keys are credit cards.
Your AI keys are credit cards.
Lock them.
Leakmoat finds every AI key in your repos and deploys, catches spend spikes, and rotates leaks in one pass.
it is all clickable,
go on and poke around
acme-ai/Every key, one list
Sample workspaceKeys 5
OpenAI key
sk-proj-…3f9a
- Where
- github/acme-ai/api
- Found in
- .env in commit 4e1c2a
- Spend cap
- No cap
- First seen
- 41 days ago
Committed to a repo with 6 collaborators and still valid. Removing the file does not remove it from git history.
Scans and protects keys across
One key. Six places it leaks.
Every agent you ship needs a key, and keys spread. Hover each place to see how it happens.
Client bundle. A NEXT_PUBLIC_ or VITE_ prefix ships the key to every visitor's browser.
Was I exposed? Find out for free.
The scanner is open source and runs on your machine. Your code never leaves it.
- Scans the working tree and full git history
- Checks if each key still works
- Flags keys with no spend cap
The command-line scanner ships with the public launch. Waitlist members get it first.
Scans in your browser. Nothing is sent.
3 exposed keys found
- OpenAIsk-proj-••••••z6Hyline 2
- Anthropicsk-ant-a••••••p3Wzline 3
- Groqgsk_DEMO••••••z6Hyline 7
From sign-in to first report in two minutes.
No proxy, no SDK, no code changes. Leakmoat looks at your stack from the outside, the way an attacker would.
- 0:00
Sign in with GitHub
Read-only access to the repos you pick. Nothing to install in your code.
- 0:40
Link where you deploy
Railway and Vercel tokens, plus a read-only usage key from OpenAI or Anthropic.
- 2:00
Read your first report
Every key, where it lives, whether it works, and which one to fix first.
Built like a security product, because it is one.
A tool that guards your secrets should hold as few of them as possible. Here is exactly what we keep.
A sample key. Edit it and watch the hash change.
What Leakmoat stores
- SHA-256 fingerprint
- computing...
- Last 4
- z6Hy
- Full key
- Never
Read-only by default
Write access is asked for only when you turn on rotation, and only for the services you choose.
Encrypted per workspace
Platform tokens are sealed with per-workspace keys held in a managed KMS, decrypted only inside the worker.
Every action logged
Each scan, alert and rotation Leakmoat runs on your accounts appears in an audit log you can export.
Open source where it matters
Read the scanner before you run it. Few dependencies, pinned versions, signed releases with provenance.
“This October, platform after platform reported leaked secrets. Every founder I know asked the same question: which of my keys were on there? Leakmoat is the tool I wanted that week.”
Ubaid
Founder, building Leakmoat in public
Cheaper than one leaked key.
One stolen key can burn thousands of dollars in a night. Plans start below a team lunch.
Most popular
Team
For startups running agents in production.
$99/month
Join waitlist- Unlimited repos
- All AI providers
- One-pass rotation
- Breach alerts
- 5 seats and audit log
Business
For agencies managing keys for clients.
$299/month
Join waitlist- A workspace per client
- 20 seats
- Compliance export
- Priority support
The scanner is free forever. The first 50 paying customers keep 50% off for life.
Frequently asked questions
Do I have to hand you my API keys?
No. Scanning needs read access to your repos. Spend alerts use a read-only usage key from OpenAI or Anthropic. Rotation is opt-in, and a detected key is never stored in full.
How is this different from GitHub secret scanning?
GitHub covers GitHub. Leakmoat also watches Railway and Vercel env vars, CI logs and client bundles, tracks what each key is spending, and pushes a new key everywhere the old one lived.
Which providers do you detect?
OpenAI, Anthropic, Google Gemini, Groq, xAI, OpenRouter, Hugging Face and Replicate keys at launch, plus Stripe live keys and AWS access keys.
Is rotation fully automatic?
Where a provider lets us create keys through its API, yes. Elsewhere you create the new key, and Leakmoat updates every service that used the old one and redeploys it.
When can I start?
The free scanner opens first, then the beta goes out to the waitlist in batches.