SECRET SCANNER
Hardcoded API keys, database passwords and tokens are a top cause of breaches. Nurbak's secret scanner finds them in your repository, including secrets left behind in git history. Free scan to start.
Create account and connect GitHubWe never store your code. We only write when you ask for a fix PR.
A key committed once and 'removed' still lives in history. We check past commits, not just the current tree.
The model tells a live Stripe or AWS key from an example placeholder, so you chase real leaks, not false alarms.
Each finding says what the secret unlocks and how to rotate it, not just a regex match.
Runs on our own model on ephemeral infra; your code and any secrets found are never sent to a third-party AI and aren't stored.
Create your account and connect GitHub.
We scan the code and git history on ephemeral infra.
The model classifies each candidate secret by type and risk.
You get the exposed secrets with rotation guidance.
Pick the repo you want to scan, public or private.
Create an account, connect GitHub and run the scan. Nurbak checks the code and git history for hardcoded API keys, tokens, passwords and other credentials, with a free scan to start.
Yes. Secrets that were committed and later deleted remain recoverable in history, so we scan past commits as well as the current code.
The model distinguishes real, live-looking credentials from obvious placeholders and test values, so you focus on genuine leaks.
No. Analysis runs on ephemeral infrastructure with our own model; your code and any secrets found are deleted after the scan and never reach a third-party AI.
A fair comparison of the main secret scanning tools: what TruffleHog, Gitleaks, GitGuardian and GitHub secret scanning actually do, which are open source, which verify live secrets, how they handle git history, and how to rotate and purge a leaked key the right way.
See which keys and credentials are exposed in your repo in minutes.
Scan my repo