Two standalone tools for discovering accidentally leaked credentials in public registries.
| Project | Target | Stack |
|---|---|---|
| leakwatch | GitHub public repos | FastAPI + React + TruffleHog |
| docker | DockerHub public images | Flask + TruffleHog |
Scans public GitHub repositories for leaked credentials (API keys, tokens, passwords). Discovers targets via GitHub stars/orgs/users, runs TruffleHog with verified-only mode, resolves disclosure channels via security.txt/SECURITY.md, and generates human-reviewed disclosure drafts. Never stores raw secrets or auto-sends disclosures.
Targeted DockerHub account scanner. Enter a username; the worker enumerates all public repositories and tags, detects application directories from image metadata, and runs TruffleHog against each image. Results stream via polling to a web UI and persist to SQLite.
- Read-only. Only public data is scanned. No enumeration beyond the initial discovery.
- Defensive. Raw secrets are redacted. Disclosure is never automated — every notification requires explicit human confirmation.
- Offensive-tool aware. Built to find what attackers already scan for, so defenders can fix it first.