🔑 KeyPot

Find exposed API keys on GitHub - A defensive security tool for monitoring API key leaks.

KeyPot scans GitHub repositories for accidentally exposed API keys from popular AI services like OpenAI, Anthropic, Google, Groq, and more. Use it to find working API keys or monitor your own keys for exposure.

🚀 Quick Start

Installation

npm install -g keypot

Basic Usage

const KeyPot = require('keypot');

// Initialize with GitHub token
const keypot = new KeyPot('your-github-token');

// Find the first working API key
const workingKey = await keypot.getFirstWorkingKey({
  services: ['openai'],
  validateKeys: true
});

console.log('Found working key:', workingKey);

CLI Usage

# List all supported API key types
keypot list

# Quick scan for working OpenAI keys (default)
keypot quick

# Get specific service keys
keypot quick --service huggingface --quiet
keypot quick --service anthropic
keypot quick --service groq

# Ultra-fast scan with randomization
keypot quick -qr

# Full scan with validation
keypot scan --validate --services openai,anthropic --max 50

# Monitor for new exposures
keypot monitor --interval 60 --validate

📚 Features

🔍 Multi-Service Support

KeyPot supports detection of API keys from 13+ popular services:

| Service | Pattern | Description | |---------|---------|-------------| | OpenAI | sk-*, sk-proj-* | GPT, DALL-E, Whisper API keys | | Anthropic | sk-ant-api03-* | Claude API keys | | Google/Gemini | AIza* | AI Studio, Gemini API keys | | Groq | gsk_* | Fast LLM inference keys | | GitHub | ghp_* | Personal access tokens | | OpenRouter | sk-or-v1-* | OpenRouter API keys | | HuggingFace | hf_* | Model hub API keys | | Replicate | r8_* | AI model hosting keys | | ElevenLabs | sk_* | Voice synthesis keys | | Luma | luma-* | Luma AI video generation keys | | Runway | key_* | RunwayML video generation keys | | Mistral | mistral_api_key | Mistral AI API keys | | Azure | various | Azure API keys and connection strings |

Quick Service Reference:

# List all supported services
keypot list

# Popular AI services
keypot quick --service openai      # ChatGPT, GPT-4, DALL-E
keypot quick --service anthropic   # Claude
keypot quick --service google      # Gemini
keypot quick --service groq        # Fast LLM inference

# Development services  
keypot quick --service github      # GitHub tokens
keypot quick --service huggingface # ML models
keypot quick --service replicate   # AI hosting

# Multiple services
keypot scan --services openai,anthropic,groq

⚡ Smart Detection

• Pattern recognition for 13+ API key formats
• Filters out test/dummy keys automatically
• Validates keys against live APIs
• Tracks invalid keys to avoid retesting
• Service-specific pattern matching for accurate results

🛡️ Responsible Scanning

• Rate limiting to respect GitHub API limits
• Minimal API calls (1 token max) for validation
• Never logs or stores discovered keys
• Supports private repository exclusion

📊 Comprehensive Reporting

• Security reports with recommendations
• Service-wise key breakdown
• Repository exposure analysis
• Critical findings highlighting

🔧 API Reference

Core Methods

new KeyPot(githubToken)

Create a new KeyPot instance with your GitHub personal access token.

const keypot = new KeyPot(process.env.GITHUB_TOKEN);

scan(options)

Scan GitHub for exposed API keys.

const results = await keypot.scan({
  maxResults: 100,           // Max files to scan
  services: ['openai'],      // Services to search for  
  validateKeys: true,        // Test keys against APIs
  excludeRepos: ['repo1'],   // Repos to skip
  includePrivate: false      // Include private repos
});

findWorkingKeys(options)

Find and return only validated, working API keys.

const workingKeys = await keypot.findWorkingKeys({
  services: ['openai', 'anthropic'],
  maxResults: 50
});

getFirstWorkingKey(options)

Get the first working API key found (fastest option).

const key = await keypot.getFirstWorkingKey({
  services: ['openai']
});

validateKey(key, service)

Validate a single API key.

const result = await keypot.validateKey('sk-...', 'openai');
console.log(result.valid); // true/false

checkMyKeys(keyPrefixes, options)

Monitor your own keys for exposure.

const exposed = await keypot.checkMyKeys(['sk-proj-abc'], {
  maxResults: 100
});

startMonitoring(options, callback)

Continuous monitoring for new key exposures.

const monitor = keypot.startMonitoring(
  { interval: 60000, services: ['openai'] },
  (newKeys) => {
    console.log(`🚨 ${newKeys.length} new keys found!`);
  }
);

// Stop monitoring
monitor.stop();

CLI Commands

keypot list

List all supported API key types and services.

keypot list

keypot scan [options]

Full GitHub scan for exposed keys.

keypot scan \
  --services openai,anthropic \
  --max 100 \
  --validate \
  --exclude user/private-repo \
  --report

keypot quick [options]

Quick scan for first working key.

keypot quick --service openai

# Quiet mode - only outputs the key
keypot quick --service openai --quiet

# Random mode - shuffles results for faster discovery
keypot quick --service openai --random

# Combined for maximum speed
keypot quick -qr

keypot validate <key>

Validate a specific API key.

keypot validate sk-... --service openai

keypot monitor [options]

Monitor for new exposures.

keypot monitor \
  --interval 60 \
  --services openai,anthropic \
  --validate

🔒 Security Best Practices

For Users

1. Use responsibly - Only scan for your own exposed keys
2. Respect rate limits - Don't overwhelm GitHub's API
3. Report responsibly - Contact repository owners about exposures
4. Secure your tokens - Keep GitHub tokens private

For Developers

1. Use pre-commit hooks to prevent key commits
2. Scan regularly for your own key exposures
3. Use environment variables instead of hardcoded keys
4. Enable GitHub secret scanning alerts
5. Implement proper secret management

📋 Examples

Find Working OpenAI Keys

const KeyPot = require('keypot');

async function findOpenAIKeys() {
  const keypot = new KeyPot(process.env.GITHUB_TOKEN);
  
  const keys = await keypot.findWorkingKeys({
    services: ['openai'],
    maxResults: 10,
    validateKeys: true
  });
  
  console.log(`Found ${keys.length} working OpenAI keys`);
  return keys;
}

Monitor Your Keys

async function monitorMyKeys() {
  const keypot = new KeyPot(process.env.GITHUB_TOKEN);
  
  // Check if your keys are exposed
  const exposed = await keypot.checkMyKeys(['sk-proj-abc123'], {
    maxResults: 50
  });
  
  if (exposed.length > 0) {
    console.log('🚨 Your keys are exposed!');
    exposed.forEach(key => {
      console.log(`Repository: ${key.file.repository.fullName}`);
      console.log(`File: ${key.file.path}`);
    });
  }
}

Batch Validation

async function validateKeys() {
  const keypot = new KeyPot(process.env.GITHUB_TOKEN);
  
  const keys = [
    { key: 'sk-...', service: 'openai' },
    { key: 'sk-ant-...', service: 'anthropic' }
  ];
  
  for (const {key, service} of keys) {
    const result = await keypot.validateKey(key, service);
    console.log(`${service}: ${result.valid ? '✅' : '❌'}`);
  }
}

Generate Security Report

async function securityAudit() {
  const keypot = new KeyPot(process.env.GITHUB_TOKEN);
  
  await keypot.scan({
    services: ['openai', 'anthropic', 'google'],
    validateKeys: true,
    maxResults: 100
  });
  
  const report = keypot.generateReport();
  
  console.log('📊 Security Report:');
  console.log(`Total keys found: ${report.summary.totalKeys}`);
  console.log(`Valid keys: ${report.summary.validKeys}`);
  console.log(`Affected repositories: ${report.summary.repositories}`);
  
  if (report.criticalFindings.length > 0) {
    console.log('\n🚨 Critical Issues:');
    report.recommendations.forEach(rec => console.log(`- ${rec}`));
  }
}

🛠️ Development

Setup

git clone https://github.com/user/keypot.git
cd keypot
npm install

Testing

# Run all tests
npm test

# Run specific test suite
npm test -- --testPathPattern=patterns

# Run with coverage
npm run test:coverage

Contributing

1. Fork the repository
2. Create a feature branch
3. Add tests for new functionality
4. Ensure all tests pass
5. Submit a pull request

📄 License

MIT License - see LICENSE file for details.

⚠️ Disclaimer

This tool is intended for defensive security purposes only. Users are responsible for:

• Complying with GitHub's Terms of Service
• Respecting API rate limits
• Using responsibly and ethically
• Not accessing keys that don't belong to them

🤝 Support

• 📖 Documentation
• 🐛 Report Issues
• 💬 Discussions

Made with ❤️ for the security community