Secret Sprawl Auditor · for engineering and DevSecOps teams
Find every leaked and stale secret, before an attacker does.
23.8 million secrets leaked on GitHub in 2024. 70% are still active two years later. Secret Sprawl Auditor will scan your repos and infrastructure for leaked API keys, stale tokens, and secrets that haven't been rotated — then give you a prioritized rotation checklist, ready for your SOC2 or ISO auditor.
In development, not available yet. Reserve a founding spot free, no card needed.
What your team can't see today
The key that’s been in .env.example for 3 years
Someone committed a real API key to the example env file in 2023. It still works. It has admin scope. Nobody remembers it’s there.
The rotation you think happened
Your team rotated the production database password last quarter. But the staging env, the CI pipeline, and two developer laptops still have the old one — and it still works.
The audit question you can’t answer
SOC2 auditor asks: which secrets have been rotated in the last 90 days? You check 4 vaults, 3 CI systems, and a shared 1Password vault. The answer takes a week.
How it will work
Point it at your repos
Connect your GitHub org or upload a local scan. It finds every secret pattern: API keys, tokens, passwords, connection strings, certificates.
See what’s live vs stale
Each secret is checked: is it still valid? When was it last rotated? Does it have overly broad permissions?
Get a rotation checklist
Prioritized by risk: live secrets with admin scope first, expired tokens that need cleanup second. Step-by-step rotation instructions per provider.
Prove compliance
Export a rotation report showing what was found, what was rotated, and when. Ready for your SOC2 or ISO auditor.
Founding pricing
Reserve now at no cost. Founding members get Secret Sprawl Auditor first, at these prices.
Starter
$49/month
For small teams and single-product companies.
- Up to 10 repos
- Monthly scans
- Secret validation (AWS, GCP, GitHub, Stripe, and more)
- Prioritized rotation checklist
- Email alerts for new findings
Free, no card. We'll email you when checkout opens.
Business
$149/month
For engineering teams at compliance-driven companies.
- Unlimited repos
- Weekly scans
- Everything in Starter
- Audit-ready rotation report (SOC2, ISO)
- Slack alerts and CI/CD pipeline scanning
Free, no card. We'll email you when checkout opens.
Questions
Is this available today?
No. Reserve a founding spot free, no card needed.
How is this different from GitGuardian?
GitGuardian monitors for new leaks in real-time at $15–30/dev/month. This audits your existing secret sprawl — the keys already out there — and gives you a rotation plan. Different problem, complementary tools.
Does it actually test if secrets are valid?
For supported providers (AWS, GCP, GitHub, Stripe, and others), yes — it makes a minimal API call to check if the key is still active, without using it for anything else.
What about secrets in CI/CD pipelines?
GitHub Actions secrets, GitLab CI variables, and environment variables in popular CI systems are included in the scan scope.
Is it safe to give this tool access to my repos?
Read-only access. The scan looks at file contents for known secret patterns. It never modifies code, creates commits, or stores your source code.