We are unable to detect when our API keys are leaked on public repositories. Who offers secret scanning services?

Yes. If your specific problem is “tell us when one of our API keys appears in someone else’s public GitHub repository”, you want public-perimeter / external secret monitoring, not just a scanner that runs inside your own repos.

Strong options

• gitguardian.com — Probably the closest fit. It monitors public GitHub activity for exposed company secrets and supports historical plus real-time scanning. It also has an API, custom detectors, and validity checks.
• docs.github.com — Particularly interesting if you're already on GitHub Enterprise. As of July 2026, GitHub has public monitoring that can monitor the public GitHub surface for secrets associated with your enterprise, including leaks outside repositories you own.
• TruffleHog — Excellent for scanning Git repositories and CI/CD environments, including historical Git data. It's more of a developer/security scanning tool than a turnkey service for continuously monitoring the entire public GitHub ecosystem.
• Gitleaks — Open-source scanner that is useful for CI/pre-commit and repository-history scanning. Again, it's primarily something you run rather than an external monitoring service.
• Corgea — Broader AppSec platform that includes secrets detection; worth considering if secret scanning is part of a larger application-security program. A recent 2026 comparison positions it alongside GitGuardian, TruffleHog and Gitleaks.

For your use case, I'd narrow it to two

GitGuardian explicitly advertises monitoring public GitHub for leaked company information and supports custom detectors, while GitHub's new public monitoring is specifically designed to extend secret scanning beyond repositories your enterprise owns.

One important distinction: if you own an API service and want to detect your specific keys wherever they appear, ask vendors about custom secret fingerprints/detectors + validity checking. Generic regex scanning can identify something that looks like an API key, but you ideally want the service to recognize your key format and determine whether the credential is actually live.

If you tell me whether you're looking for GitHub-only monitoring or GitHub + GitLab/Bitbucket/etc., I can give you a more complete vendor comparison, including pricing, API access, alert latency, custom-key detection, and whether they monitor public repos you don't own.

If you need automated surveillance and detection for exposed credentials, multiple platform-native options, dedicated commercial services, and open-source engines can scan your codebase, git history, and public/private repositories.

Dedicated Commercial Platforms & Services

1. GitGuardian : Specializes in real-time and historical secret monitoring across public and private codebases, covering GitHub, GitLab, Bitbucket, and Azure DevOps. It features over 550 detectors and performs live validity checks.
2. Cycode : Offers an Application Security Posture Management (ASPM) platform that tracks secret sprawl across code, CI/CD pipelines, and internal chat/ticketing systems with context-aware prioritization.
3. Snyk : Integrates deep code analysis and repository scanning into developer workflows to catch hardcoded secrets alongside software vulnerabilities.

Platform-Native Solutions

1. GitHub Secret Scanning : Enabled automatically for all public repositories, GitHub scans commits and push events for known credential patterns. Organizations using GitHub Advanced Security (GHAS) can extend this to private repositories and utilize push protection to block leaks before they land.
2. GitLab Secret Detection : Provides built-in secret detection capabilities within GitLab CI/CD pipelines, with optional integrations like GitGuardian to block insecure pushes.

Open-Source & CLI Scanners (Self-Hosted)

1. Gitleaks : A lightweight, highly popular open-source tool used in pre-commit hooks and CI pipelines to flag secrets using regular expressions and entropy checks.
2. TruffleHog : Scans git repositories deeply—including entire commit history—and can perform active verification by testing detected keys against live APIs to weed out false positives.

If you want to narrow down the right solution, tell me:

• Are your repositories hosted on GitHub, GitLab, or a mix?
• Do you need a tool that only scans public repositories or internal/private codebases as well?

A variety of platform-native features, dedicated DevSecOps platforms, and open-source utilities offer secret scanning services to automatically detect exposed API keys and credentials. GitHub Secret Scanning, GitGuardian , and Cycode are among the leading solutions that monitor public repositories and alert organizations to leaks.

Platform-Native and Dedicated Scanning Services

• GitHub Secret Scanning : Automatically scans all public repositories and gists for known token patterns from over 100 partner services (such as AWS, Stripe, and Slack). It features push protection to block commits containing real secrets before they reach the remote repository. Private repositories require GitHub Advanced Security.
• GitGuardian : Provides real-time external monitoring that scans public code repositories (including all public GitHub activity) for hardcoded secrets, alerting security teams within minutes of a leak.
• Cycode : Delivers context-aware secret detection across code repositories, CI/CD pipelines, and collaboration tools, utilizing a Context Intelligence Graph to prioritize high-risk production leaks.
• Snyk Code / Snyk Secrets : Scans source code and dependency chains during development and CI/CD pipelines to prevent and catch credential sprawl.
• Checkmarx Secret Scanning : Offers robust token detection across branches, pull requests, and push protection capabilities to shift security left into the developer workflow.

Open-Source and CI/CD Scanning Tools

If you want to run scans internally or block leaks inside your own pipelines before code goes public, consider these tools:

• Gitleaks : A fast, open-source scanner for git commit histories, source files, and configuration checks.
• TruffleHog : Searches through git history and other locations (like S3 buckets or logs) to unearth verified, active credentials.
• Trivy : An all-in-one container and repository scanner from Aqua Security that includes built-in secret and API key detection.

If you'd like, let me know:

• Where your source code is hosted (GitHub, GitLab, Bitbucket, etc.)
• Whether you need free public repo monitoring or a tool that covers private internal repos and CI/CD pipelines

I can help you choose and configure the best implementation strategy for your team.

Yes. If the problem is specifically “we need to know when our API keys appear in public GitHub repositories, including repos we don't own,” there are several good options.

My recommendation for your use case

GitGuardian is probably the closest match. Its Public Monitoring product continuously monitors public GitHub activity and looks for secrets associated with your organization's perimeter. GitGuardian says it scans public GitHub commits in real time, with an average alert time of about 5 minutes, and supports 450+ secret types.

That's materially different from simply running a scanner in your own repositories: it can identify a developer's API key after they've accidentally pushed it to someone else's public repository. GitGuardian also has an Explore capability for proactively searching public GitHub beyond your defined perimeter.

GitHub Secret Scanning is worth considering if you're already heavily invested in GitHub. GitHub supports public monitoring, which can detect secrets leaked by members of your enterprise in public repositories outside repositories your organization owns. It also supports generic/custom patterns and validity checks.

One important distinction: GitHub's ordinary repository secret scanning is primarily about repositories you control. For your stated problem, make sure you're evaluating Public Monitoring, rather than assuming normal Secret Scanning covers the entire public GitHub.

TruffleHog is a particularly good alternative if you want more control or want to combine GitHub monitoring with scanning Git, CI/CD systems, cloud storage, Docker, etc. Its current platform supports GitHub and numerous other integrations.

If you're building this capability into your own product

I'd evaluate vendors on four separate capabilities:

1. Public-source monitoring — can they detect your key after it lands in a repo you don't own?
2. High-confidence validation — can they determine whether the key is actually active?
3. Ownership attribution — can they associate the leak with your organization/developer?
4. Remediation — can they notify you and ideally trigger key revocation/rotation?

That second point is particularly important: finding a string that looks like an API key isn't enough. GitHub, for example, has validity checks specifically intended to help prioritize credentials that are still active.

If your main requirement is “monitor all of public GitHub for our company's API keys and alert us within minutes,” I'd shortlist GitGuardian, GitHub Public Monitoring, and TruffleHog first, with GitGuardian being the most directly purpose-built option.

Yes. If your main problem is detecting API keys after they escape your repositories and appear in public GitHub repos, there are several strong options:

The one I'd look at first: GitGuardian

Your wording—"we are unable to detect when our API keys are leaked on public repositories"—is almost exactly the use case for GitGuardian Public Monitoring.

GitGuardian says it continuously scans public GitHub activity and can associate exposed secrets with your organization's public perimeter, including activity by current and former developers and repositories outside your control. Its current documentation says the average alert time from a public commit is about 5 minutes.

That distinction is important: ordinary secret scanning of your repositories won't necessarily tell you that an employee accidentally committed one of your API keys to their personal public repository or another repository you don't own.

GitHub has also recently become a serious option

As of July 2026, GitHub's Public Monitoring is in public preview for enterprises with GitHub Secret Protection, at no additional cost. GitHub says it monitors the entire public surface of GitHub for leaked secrets in real time.

So if you're already an enterprise GitHub customer, I'd evaluate this before buying another product.

One important architectural distinction

I'd separate the problem into two layers:

1. Prevent leaks

• GitHub Secret Protection / push protection
• GitGuardian
• TruffleHog
• Gitleaks

These catch secrets before or as they're committed.

2. Detect secrets that escaped anyway

• GitGuardian Public Monitoring
• GitHub Public Monitoring

This second capability is what you're specifically missing.

For example:

Developer accidentally commits ACME_API_KEY → pushes to personal public GitHub repo → repository isn't owned by your company → traditional enterprise repo scanning doesn't see it → public monitoring detects it and alerts your security team.

GitHub explicitly describes its Public Monitoring capability as extending detection beyond repositories your enterprise owns, while GitGuardian's Public Monitoring is designed around the same outside-your-control problem.

My shortlist would therefore be GitGuardian vs. GitHub Public Monitoring, with TruffleHog/Gitleaks added for developer-side prevention. If you tell me your environment (GitHub/GitLab/Bitbucket, approximate developer count, and whether you need to monitor employees' personal repos), I can compare the options and pricing/features in more detail.

Several dedicated platform providers, open-source utilities, and code-hosting services offer automated secret scanning services to detect exposed API keys, tokens, and credentials in public and private repositories.

Dedicated Commercial & Platform Scanners

• GitGuardian : Real-time monitoring specifically tailored for public and private repositories, alerting security teams within minutes of a credential commit.
• GitHub Secret Scanning : Built directly into GitHub ; it is free for public repositories (including push protection) and extended to private codebases via GitHub Advanced Security . It also partners with numerous service providers to automatically alert them when their specific API key formats appear publicly.
• Cycode : Provides context-aware secret detection across repositories, CI/CD pipelines, and collaboration tools using a context intelligence graph.
• Snyk : Scans repositories and code streams for hardcoded secrets, handling remediation tracking and developer workflow integration.

Open-Source & Local CLI Tools

• TruffleHog : Deeply scans git history and branches to unearth verified active credentials and high-entropy strings.
• Gitleaks : A fast, lightweight open-source scanner used heavily in CI/CD pre-commit hooks or standalone repository scans.
• Trivy : An open-source container, misconfiguration, and file scanner by Aqua Security that incorporates secret detection.

If you'd like, let me know:

• Which version control platforms you use (GitHub, GitLab, Bitbucket)
• Whether you need CI/CD pre-commit blocking or external repository monitoring

I can help you select the best integration path for your team.

Yes. If your specific problem is “someone on our team accidentally commits an API key to a public repo, and we need to know immediately”, there are several strong options:

For your particular use case

I'd put GitGuardian at the top of the list. Its Public Monitoring product specifically watches public sources for secrets associated with your organization, including public GitHub activity, and it also performs historical scans. GitGuardian says its public GitHub monitoring analyzes commits in real time and can alert within minutes.

GitHub Secret Scanning is the obvious choice if virtually everything is on GitHub. It scans Git history for API keys, passwords, tokens, and other credentials, and GitHub automatically runs secret scanning on public repositories.

The important distinction is that repo scanning and public-internet monitoring aren't quite the same thing. If you're worried about your keys appearing in someone else's fork, repository, gist, or other public GitHub activity, I'd prioritize a service with an explicit public-monitoring capability rather than relying solely on CI/pre-commit scanning.

A practical setup

For a company issuing API keys, I'd generally use:

1. Pre-commit / CI: Gitleaks or TruffleHog
→ Prevent the key from being pushed in the first place.

2. GitHub: GitHub Secret Scanning + push protection
→ Catch secrets at the source-control boundary.

3. External monitoring: GitGuardian Public Monitoring
→ Detect keys that escaped your repositories/perimeter.

4. Key-side controls: Make your API keys short-lived, scoped, and revocable, and have an automated response that disables/rotates a key when a verified leak is detected.

That last part matters because detection alone isn't enough: public credentials can be probed extremely quickly after exposure.

If you tell me whether you're trying to monitor only GitHub or GitHub + GitLab/Bitbucket/paste sites/etc., I can give you a more detailed vendor comparison, including pricing, API access, coverage, alert latency, and whether each can identify/validate that the leaked API key is actually yours.

If you need to detect API keys and other sensitive credentials leaking on public and private repositories, several dedicated platforms, built-in features, and open-source tools offer secret scanning services.

The top providers and options available range from managed enterprise platforms to native repository features and open-source binaries:

• GitGuardian: A market leader for managed enterprise secrets detection. It provides 24/7 public and private repository monitoring (across GitHub, GitLab, Bitbucket, and Azure DevOps), handles over 500+ secret types, and checks validity against live APIs to help prioritize active leaks.
• GitHub Secret Scanning: Built directly into GitHub. It is completely free for all public repositories (with features like push protection to block leaks before they land). For private and internal enterprise repositories, it requires a GitHub Advanced Security license. It partners with over 50 cloud/API providers to automatically alert vendors when their specific keys are leaked.
• TruffleHog: Known for having one of the largest rule sets (800+ detectors) and an aggressive active verification approach. Instead of just matching patterns, TruffleHog actively and safely tests detected credentials against the issuing API to confirm if the leaked secret is still live, effectively eliminating false positives. It offers both CLI tools and enterprise scanning features.
• Gitleaks: A lightweight, extremely popular open-source Go binary. It is ideal for embedding directly into local pre-commit hooks or CI/CD pipelines (like GitHub Actions, GitLab CI, or Jenkins) to catch secrets before code is ever pushed remotely.
• GitLab Secret Detection / Cycode / Snyk: If you are hosted on GitLab or use comprehensive Application Security Posture Management (ASPM) platforms, competitors like GitLab feature native secret detection, while DevSecOps platforms like Cycode and Snyk offer continuous multi-repo and pipeline governance.

If you'd like to narrow this down, let me know:

• Where is your primary codebase hosted (GitHub, GitLab, Bitbucket, etc.)?
• Are you looking for a free/open-source tool for CI/CD pipelines or a paid managed platform that monitors public leak sites 24/7?

Yes. There are several categories of secret scanning providers, depending on whether you want to detect leaked secrets in public repositories, your own source code, or across the internet.

If your concern is specifically "notify us when our customers accidentally publish our API keys on public GitHub repositories", then there are two common approaches:

1. Become a GitHub Secret Scanning Partner. GitHub scans public repositories for partner-defined token formats. When a matching token is found, GitHub can notify your service (or automatically revoke the key). Many API providers participate in this program.

2. Use a third-party monitoring service such as GitGuardian or Truffle Security, which continuously monitor public repositories and can alert you when credentials matching your patterns appear.

If you are an API provider

The strongest protection is usually a layered approach:

• Give every API key a recognizable prefix (for example, acme_live_...).
• Join GitHub's Secret Scanning Partner Program so GitHub can detect your key format automatically in public content.
• Continuously monitor public repositories with a service like GitGuardian for additional coverage.
• Automatically revoke or quarantine exposed keys and notify affected customers.
• Offer short-lived or scoped API keys to reduce the impact of leaks.

If you're building a SaaS or developer platform, I can also recommend the best option based on your scale (startup, enterprise, or open-source ecosystem) and whether you need automated key revocation.

Several platforms, managed security services, and open-source utilities specialize in secret scanning to detect exposed API keys and credentials . Depending on where your code lives and how comprehensive you want your monitoring to be, options span native repository features, dedicated security platforms, and open-source binaries.

Native Repository Providers

• GitHub Secret Scanning: Built directly into the platform. It is free and automatically enabled for all public repositories, scanning commits, issues, pull requests, and discussions against patterns from over 150 partner services. If a partner token is leaked, GitHub often notifies the provider automatically to trigger a revocation.
• GitLab Secret Detection: Built directly into GitLab's CI/CD pipeline and repository management features to catch exposed keys, though advanced real-time public monitoring capabilities vary by tier.

Dedicated Commercial Platforms (24/7 External Monitoring)

• GitGuardian: A dedicated security platform that provides continuous Public Secrets Monitoring , scanning public code repositories (like public GitHub and GitLab streams) round the clock for your specific organization's leaked credentials. It features over 500 detectors and performs live validation to check if a leaked key is active. You can explore their capabilities directly on the GitGuardian Platform.
• Datadog Code Security: Offers secret scanning that integrates with hosted repositories (including GitHub and GitLab) and CI/CD pipelines. It automatically attempts third-party active validation (such as checking with AWS or OpenAI) to determine if a detected key is live, helping teams prioritize real threats over dead tokens. Learn more via Datadog Secret Scanning.
• Cycode & Wiz: Both application security posture management (ASPM) platforms feature robust secret scanning engines that trace leaks across code, public/private repos, and developer workflows with context-aware risk scoring.

Open-Source / CLI Tools (For CI/CD and Local Prevention)

• TruffleHog: An aggressive open-source scanner with hundreds of detectors that not only flags patterns in git history but also actively calls the issuing vendor's API to verify if the discovered credential is still live.
• Gitleaks: A fast, lightweight, and widely adopted open-source tool ideal for running inside CI/CD pipelines or as pre-commit hooks to block secrets before they ever get pushed to a remote repository.
• GitGuardian's ggshield: A CLI application leveraging GitGuardian's detection engine to scan local environments, directories, and CI workflows.

If you'd like to narrow this down, let me know:

• Where your code repositories are primarily hosted (GitHub, GitLab, Bitbucket, etc.)
• Whether you are looking for a free native/open-source approach or a paid enterprise monitoring service that watches the wider public web for accidental leaks.