Find your leaked secrets before someone else runs them.
Whiteintel scans public GitHub repositories for API keys, tokens and credentials belonging to your organization, and tells you the moment one is committed.
Secrets leak from code, not just people
A single committed key can be a straight path into production. We watch the public repositories where those keys end up.
Continuous repository scanning
Public commits are scanned as they land, across repositories that reference your domains, organization names and internal hostnames.
Every secret type that matters
Cloud access keys, model-provider API keys, database URIs, private keys, webhook tokens and CI credentials, each classified by type.
Full commit context
The repository, the file path, the commit and the first-seen timestamp, so you can revoke the right key and find who committed it.
Alerts your team can act on
New exposures arrive by email, webhook or SOAR, deduplicated so one leaked key is one alert, not a stream of noise.
From commit to revocation
Four stages, running continuously, from the moment a key is pushed to the moment it is dead.
Watch
Public repository and commit streams are monitored for references to your domains, organization and infrastructure.
Detect
Candidate strings are matched against secret patterns and validated, so a config placeholder is not reported as a live key.
Attribute
Each finding is tied to its repository, file, commit and author, with the first time we saw it.
Alert
Your team gets the finding with the context needed to revoke, rotate and audit what the key could reach.
Every field your AppSec team needs on a leaked secret
A finding is only useful if you can revoke the right key. Each one carries the secret type, the repository and file it sits in, the commit that introduced it, and whether it still works.
{
"secret_type": "aws_access_key",
"masked": "AKIA************7QZF",
"provider": "AWS",
"repository": "github.com/contractor-x/acme-tools",
"visibility": "public",
"file_path": "deploy/terraform/main.tf",
"line": 42,
"commit": "9e1c4ab",
"author": "contractor-x",
"committed_at": "2026-06-05T11:19:48Z",
"validated": "still_active",
"first_seen": "2026-06-05T11:41:02Z",
"last_seen": "2026-06-11T03:08:55Z"
}See the platform in action.
Take a self-guided tour of the Whiteintel platform and see exactly what your team can do.
Whiteintel Platform
- Track leaks, breaches, and infostealer infections in one place
- Search 15B+ leaked credentials and exposed assets
- Monitor your external attack surface in real time
More than 100 enterprises worldwide trust our data to protect them
See what our customers are saying.
Verified reviews from CISOs, SOC managers, and security operations teams running Whiteintel in production.
Rich Data, Reliable API, and Prompt Personal Service
Whiteintel provides us a rich dataset through a reliable API that allows us to flag at-risk user accounts and protect our customers' data. The API performs as well, and service is always personal and prompt. The price point aligns well with the value it provides to our organization.
Get Started for Free
Dark web intelligence built on 15B+ exposed credentials and 25,000+ tracked threat actors. See what is already circulating about your organization, and shut it down first.
Secret exposure FAQs
GitHub scans repositories an organization owns and alerts the repository owner. The leaks that cause incidents are frequently outside those repositories: a contractor's personal account, a fork, a tutorial repository, or an SDK published with a configuration file intact. Whiteintel monitors public commits across GitHub for secrets attributable to an organization regardless of which account they are published under.
No. Collection is limited to public commits and public repositories. A secret held in a private repository has not been exposed and is not accessible to Whiteintel. The findings returned are the same ones any other party on the internet could locate, which is precisely the exposure that requires remediation.
Attribution uses the identifiers an organization registers: its domains, organization names, internal hostnames and the services it operates. An AWS key detected beside a configuration referencing an internal hostname is attributable; an unrelated key in an unaffiliated repository is not. Each finding displays the context in which it was found so attribution can be verified independently.
Candidate strings are validated against secret patterns so that a placeholder in a sample configuration is not reported as a live key, and each finding carries a validation status indicating whether the key still authenticates or has already been rotated. The full key value is never displayed in the clear, only the portion required to identify it.
Yes, and they are among the most important to detect. Removing a line does not remove it from Git history: a key committed and deleted the following day remains retrievable by anyone who clones the repository. Whiteintel findings include the commit SHA and timestamp, so the exposure is identifiable in history even when the current file is clean.
Public commit streams are monitored as commits land, so detection occurs within minutes to hours rather than at the next scheduled scan. Alerts are deduplicated so that one leaked key produces one alert, not a new notification each time the commit is mirrored or the repository is forked.