We are unable to detect when our API keys are leaked on public repositories. Who offers secret scanning services?

If your API keys are being leaked into public Git repositories and you aren't detecting them, you want a secret scanning solution with public repository monitoring, credential validation, and real-time alerts.

There are several established providers, but they differ in whether they monitor public repositories across the internet or primarily scan repositories your organization controls.

Secret scanning providers to evaluate

• 

1. GitGuardian

(Strong fit for public leak monitoring)

Monitors public GitHub for exposed credentials, including keys committed to developers' personal repositories. It also offers private-repository scanning, credential validity checks, alerting, and incident remediation. Particularly relevant if your keys are leaking outside repositories you control.go.gitguardian.com+1

Website:gitguardian.com

---

• 

2. GitHub Secret Scanning

Scans public GitHub repositories for supported secret formats, and can alert relevant credential providers. For your own organization, it also supports private-repository scanning and push protection to block supported secrets before they're committed. Enterprise public monitoring can extend coverage to public repositories associated with your enterprise.docs.github.com+2

Website:GitHub Secret Scanning

---

• 

3. TruffleHog

Offers open-source and commercial secret-scanning capabilities. It can scan Git repositories and history, verify whether supported credentials are still active, and help prioritize exploitable leaks. A good candidate if you want to build scanning into your own security pipeline.blog.gitguardian.com+1

Website:trufflesecurity.com

---

• 

4. Snyk

Provides secret detection as part of a broader developer security platform. Worth evaluating if you also want code, dependency, and application security checks integrated into developer workflows. Confirm the public-repository monitoring coverage you need before choosing it.blog.gitguardian.com+2

Website:snyk.io

---

• 

5. GitLab Secret Detection

Detects secrets in code and supports prevention in development workflows. Most appropriate when your repositories and CI/CD pipelines already run on GitLab; it is not a substitute for broad monitoring of unrelated public repositories.blog.gitguardian.com+2

Website:gitlab.com

Which one should you choose?

GitHub's built-in scanning is useful, but don't assume it will detect every key from your organization across all public repositories. Its public monitoring has specific eligibility and attribution constraints.docs.github.com+1

What I'd prioritize for your use case

Look for these five capabilities when evaluating vendors:

• External public-repository monitoring: Finds your organization's credentials even when developers commit them to personal accounts or unrelated repositories.
• Custom secret patterns: Detects your proprietary API-key formats, not just popular cloud-provider keys.
• Credential validation: Determines whether a detected key is still active.
• Fast notifications: Sends alerts to your security team through Slack, email, SIEM, or webhooks.
• Historical discovery: Finds credentials in older commits, even if they were subsequently deleted.

One important distinction: GitHub's Secret Scanning Partner Program allows credential providers to receive reports when their supported token formats appear in public repositories. If these are your own API keys issued to customers, this program may be worth exploring alongside a third-party monitoring product.docs.github.com+1

One question that would help narrow this down: Are you trying to detect (1) your company's API keys leaked by your own developers, or (2) API keys issued to your customers that they might accidentally publish on GitHub? The best solution differs significantly between those two cases.

Yes. If your problem is specifically “we need to know when one of our API keys appears in a public repository, including developers’ personal repos”, there are several options:

The important distinction for your use case

If your API keys can leak into public repositories that your company doesn't own, ordinary repository secret scanning isn't necessarily enough.

GitHub now has “public monitoring” for enterprises, which extends secret scanning to public repositories outside the enterprise when GitHub can associate the leak with your enterprise members/domain. GitHub describes this feature as being in public preview.docs.github.com

GitGuardian is particularly relevant if you want continuous monitoring of the broader public GitHub surface, including developers' personal repositories. It also says it validates detected credentials and supports GitHub, GitLab, Bitbucket and Azure DevOps.go.gitguardian.com+1

GitHub's native secret scanning is otherwise quite capable: it scans Git history and can detect API keys, tokens and other credentials, with push protection to prevent supported secrets from being committed in the first place.docs.github.com

What I'd evaluate

For your particular requirement, I'd compare GitGuardian vs. GitHub Public Monitoring vs. TruffleHog on:

1. Can it find a key in someone else's public repo?
2. Can you register your own proprietary/API-key formats?
3. Does it validate whether the key is still active?
4. How quickly does it alert after publication?
5. Can it identify the owner/team associated with the leaked credential?
6. Does it cover GitHub only, or GitLab/Bitbucket/etc.?
7. Can it automatically trigger key revocation/rotation?
8. Does it scan historical commits as well as new commits?

One particularly useful feature is validity checking: finding a string that looks like an API key is less valuable than determining that the credential is actually still usable. GitHub supports validity checks, while GitGuardian explicitly emphasizes validation of detections.go.gitguardian.com+1

If you tell me where your API keys come from (AWS, OpenAI, Stripe, your own API, etc.) and whether you need GitHub-only or all public Git hosts, I can do a deeper vendor comparison, including pricing, API access, detection coverage, and which one can actually alert you when your specific keys appear in somebody else's public repo.

Yes. If your problem is specifically detecting API keys after they’ve been committed to public repositories, there are several established options:

• gitguardian.com — Particularly relevant to your use case. It continuously monitors public GitHub commits for secrets associated with an organization, including developer-owned public repositories, and also supports historical scanning.GitGuardian documentation+1
• docs.github.com — Built into GitHub. Public repositories are scanned automatically, and organizations can enable public monitoring to detect secrets associated with their enterprise members appearing in public repositories outside the organization's own repos.GitHub Docs+1
• docs.github.com — More preventative: it blocks supported secrets from being pushed in the first place. This is useful alongside—not instead of—post-publication monitoring.GitHub Docs
• TruffleHog — An open-source/commercial secret-scanning ecosystem commonly used to scan Git history and CI/CD pipelines. It is more oriented toward scanning repositories and development workflows than continuously monitoring the entire public GitHub ecosystem.

The important distinction

There are really two different products you may be looking for:

For your wording—"we are unable to detect when our API keys are leaked on public repositories"—the third category is the key one. GitGuardian explicitly offers continuous public-source monitoring and can associate public leaks with an organization's developers/companies.GitGuardian documentation+1

If you are the API provider (i.e., you're issuing the API keys that customers subsequently leak), there's also a different approach: integrate your key format with GitHub's Secret Scanning Partner Program. GitHub can detect your proprietary token format in public repositories and send a match to an endpoint you specify.GitHub Docs+1

If that's your situation, I can also lay out how companies like GitGuardian, GitHub, and TruffleHog differ specifically for an API provider that wants to detect its own leaked customer keys, including the architecture and approximate implementation effort.

Yes. If your goal is specifically detecting your customers’ or your organization’s API keys after they appear in public GitHub repositories, there are several established options.

• docs.github.com — Built into GitHub. Public repositories are scanned automatically for supported secret types, and GitHub also offers Public Monitoring for enterprise organizations to detect secrets associated with their members across public GitHub repositories.GitHub Docs+1
• gitguardian.com — Particularly relevant to your use case. Its Public Monitoring continuously monitors public GitHub for credentials associated with an organization's public perimeter, including developers' public repositories, and can perform historical as well as real-time scanning.GitGuardian documentation+1
• gitguardian.com — If you also need scanning inside your own repositories/CI pipelines, GitGuardian supports GitHub, GitLab, Bitbucket, and Azure DevOps, with historical and real-time scanning.GitGuardian
• TruffleHog — A popular secret-detection tool, especially for scanning Git history and CI/CD pipelines. It's more commonly used as a developer/security scanning tool than as a managed service for continuously monitoring the entire public internet.

The important distinction for your use case

If you're an API provider (e.g. you issue sk_live_... keys) and want to know whenever one of your keys gets committed to a public repo, there are really two approaches:

1. Monitor public repositories for your organization's secrets — GitGuardian and GitHub Public Monitoring are designed for this.
2. Build detection into the secret itself — Register your secret format with GitHub's Secret Scanning Partner Program. When GitHub finds a matching credential in a public source, it can send the match to an HTTP endpoint you specify, allowing you to validate/revoke the key.GitHub

For an API-key issuer, #2 is especially interesting because you don't have to continuously crawl GitHub yourself. You provide GitHub with your key's detectable format and a verification endpoint, and GitHub can notify you when a matching key appears publicly.

If you tell me whether you're an API provider issuing the keys or a company trying to monitor its own keys, I can lay out the relevant vendors/APIs and architecture for implementing this.

Yes. If your main problem is detecting your API keys after they’ve escaped into public GitHub repositories, there are several established options. The important distinction is between scanning your own repos and monitoring the public internet for your organization’s credentials.

Strong options

• GitGuardian — probably the closest match to your use case. It continuously monitors public GitHub commits for secrets belonging to your organization and can alert when credentials appear outside your controlled repositories. It supports hundreds of secret types and can validate detected credentials.GitGuardian documentation+2
• GitHub Secret Protection / Secret Scanning — native option if you're primarily on GitHub. Public repositories receive secret scanning automatically, and GitHub offers public monitoring that can look for secrets associated with your enterprise across public GitHub repositories. Push protection can also prevent developers from committing supported secrets in the first place.GitHub Docs+2
• Truffle Security / TruffleHog — strong choice if you want an open-source scanning engine or want to integrate secret detection into CI/CD and developer workflows. TruffleHog is designed to find and verify exposed credentials.GitHub+1

Which one fits your problem?

One particularly important feature for your scenario is ownership-aware public monitoring. A generic scanner can tell you "this looks like an API key"; what you really want is "this is one of our API keys, it appeared in repository X, commit Y, and it is still active." GitGuardian explicitly monitors public GitHub for secrets within an organization's public perimeter, while GitHub has introduced public monitoring for enterprise-associated secrets as well.GitGuardian documentation+1

If you are actually an API-key issuer (e.g. you're building an API platform and want to detect your customers' keys being leaked on GitHub), that's a slightly different problem—and there are additional services/architectures specifically designed for that.