OPEN SOURCE · MIT · NPM

keysnitch: find leaked keys in any text

A JavaScript library that reads a string and tells you where the credentials are: an Atlassian API token in a Jira comment, a Google key in a URL, a database password in a pasted .env file.

• 250 rulesfrom 129 companies and projects
• 220 gitleaks rulesevery one that applies to text
• Zero dependenciesnothing to audit but the package
• Linear timeevery rule is checked before it runs

Why we built it

On 1 November 2026 we put 1,400 fake leaks through the two scanners we had: Secret Sentinel, then built on secretlint, and our free leak checker. Secret Sentinel found none of 50 Atlassian API tokens. In an app for Jira and Confluence, that is the one key it must not miss. Neither scanner found a password in a .env line, in curl -u or in a sentence. So we wrote one engine for both, and opened it.

What it finds

• Every rule of gitleaks v8.30.1 for text. Two are left out: one matches file names, one guesses by entropy.
• Its own rules for keys gitleaks misses: Atlassian access tokens and Bitbucket app passwords, Azure Storage keys and SAS signatures, Google OAuth secrets, Groq, xAI, Replicate, Docker Hub, Figma, Supabase and more.
• Passwords by the word next to them: in URLs, settings and .env files, in a sentence, in the password column of a table, in Authorization: Bearer and Basic headers, curl -u and docker login -p.
• Documentation placeholders such as your_api_key, ${TOKEN}, <secret> and xxxx are never reported.

Every rule, by company: docs/rules.md.

Install and use

Node 24 or newer. The code is plain TypeScript with no Node APIs, so it also runs in browsers, workers, serverless functions and Atlassian Forge.

import { mask, scan } from "keysnitch";

const { findings } = scan(text);
for (const finding of findings) {
  const value = text.slice(finding.start, finding.end);
  console.log(finding.vendor, finding.label, mask(value));
}
// GitHub  GitHub personal access token  ghp_****x9Q2

A finding is a range: where the secret starts and ends, the company, the name and a severity. The value itself never lands in a finding, an error or a log. When rules overlap, one finding covers all of them, so nothing stays readable after you redact. You can add your own rules with defineRule(), which refuses any pattern that could make matching slow.

How it compares

The same 1,400 fake leaks in 28 shapes: random values in the vendors' published formats, pasted the way people paste them into tickets and pages.

Read the last number with care: keysnitch was written after this test, by people who knew its shapes, so the result is not blind. It misses 8 passwords in a table column that are made only of letters. That is on purpose: a word like "regenerate" in a table is not a password. Every shape, with the method: our secret sprawl test.

Where it runs today

• Secret Sentinel for Jira and Confluence runs on keysnitch since 6 November 2026 (Jira 2.12.0, Confluence 4.5.0). It redacts what keysnitch finds in issues, comments and pages, inside Atlassian Forge.
• The free API key leak checker runs it in your browser. Paste a snippet and see what it finds. Nothing leaves the page.

Limits

keysnitch is a safety net, not a guarantee. It finds credentials with a known shape. It does not guess random strings by entropy, so a password with no word next to it, or a token of an unknown format, is not found. It scans text only: no files, archives or images. It does not look for personal data such as card numbers. That is a separate layer in Secret Sentinel.

Further reading

• Secret Sprawl: How to Detect and Prevent It
• How Secret Sentinel Detects Secrets
• From Entropy to LLMs: What the Research Says About Detecting Secrets
• Secret Scanner Accuracy: Precision Is Not Enough
• Common Types of Leaked Credentials
• envseal, our open-source CLI for secrets in git