KeyHog
What it is
KeyHog is a free, open-source Rust secret scanner for Linux, macOS, Windows, or self-hosted deployments. It searches for leaked API keys, tokens, passwords, and other credentials across repositories, Git history, archives, Docker images, URLs, HAR captures, browser assets, collaboration content, running systems, and inventories from GitHub, GitLab, Bitbucket, S3, GCS, and Azure Blob. The project lists 934 service-specific detectors, decode-through scanning, context-aware evidence and suppression, and optional live provider verification. GPU execution can use CUDA, native Metal, or portable WGPU, with calibration selecting a parity-tested backend. Its GitHub Action scans checked-out trees, fails on high or critical findings, uploads SARIF to Code Scanning, and keeps a workflow artifact. Other documented CI options include GitLab, CircleCI, Jenkins, Buildkite, and shell jobs. A Unix daemon checks changed repository blobs before commits; Windows uses in-process scanning. KeyHog requires Rust 1.89 or newer.
For and against
For
- 934 service-specific detectors
- Scans repositories, containers, cloud, and browser assets
- GitHub Action with SARIF output
- CI, pull-request, and pre-commit support
- MIT OR Apache-2.0 licensing
Against
- Requires Rust 1.89 or newer
- Directory scans skip native binaries by default
- Live verification is unsupported for some detectors
- Verification sends credential-derived requests
The verdict
KeyHog covers many source types and deployment contexts, with extensive CI and local scanning options. Review its Rust requirement, binary-scan setup, and live-verification behavior before adopting it.
Who it suits
It suits developers, security teams, and organizations scanning source, infrastructure, and collaboration data for exposed credentials. It also fits teams needing CI, pull-request, push-protection, or pre-commit scanning.
Plans and prices
KeyHog
Open-source · MIT OR Apache-2.0 · install via crates.io
Read 9 Oct 2026 · github.com
On the record
- CI integration
- The GitHub Action scans a checked-out tree, fails on high or critical findings, uploads SARIF to Code Scanning, and retains a workflow artifact.github.com · read 9 Oct 2026
- Detection
- The repository describes 934 service-specific detectors, decode-through scanning, context-aware evidence and suppression, and optional live provider verification.github.com · read 9 Oct 2026
- GPU backends
- KeyHog supports CUDA, native Metal, and portable WGPU execution, with calibration that routes to a parity-proven backend.github.com · read 9 Oct 2026
- License
- The code and detector TOMLs are dual-licensed MIT OR Apache-2.0, and the repository permits commercial use, embedding, forks, and hosted services under either license.github.com · read 9 Oct 2026
- Local guard
- KeyHog can run a Unix daemon to check changed repository blobs for pre-commit secret detection; on Windows the documented alternative is in-process scanning.github.com · read 9 Oct 2026
- Other CI
- The project documents CI use with GitLab, CircleCI, Jenkins, Buildkite, and generic shell jobs.github.com · read 9 Oct 2026
- Purpose
- KeyHog is an open-source Rust secret scanner that finds and verifies leaked API keys, tokens, passwords, and credentials across code, Git history, containers, cloud storage, browser assets, collaboration content, and running systems.github.com · read 9 Oct 2026
- Scan limit
- A plain directory scan does not inspect native binaries; users must pass `--binary` and use a build with the binary feature.github.com · read 9 Oct 2026
- Scanning sources
- Documented sources include repositories and Git history, archives, Docker images, URLs and HAR captures, GitHub collaboration content, GitHub/GitLab/Bitbucket inventories, and S3/GCS/Azure Blob inventories.github.com · read 9 Oct 2026
- Security behavior
- Endpoint fetching is bounded and SSRF-screened, while private cloud endpoints and credential forwarding require explicit trust flags.github.com · read 9 Oct 2026
- Security reporting
- The maintainer asks users to report security issues through GitHub private vulnerability reporting or email [email protected].github.com · read 9 Oct 2026
- System requirement
- KeyHog requires Rust 1.89 or newer.github.com · read 9 Oct 2026
- Telemetry
- The documented performance report omits source content, credential values, raw paths, raw URLs, and raw configuration values.github.com · read 9 Oct 2026
- Verification limit
- Live verification sends credential-derived requests to provider endpoints, and the repository states that not every detector supports verification.github.com · read 9 Oct 2026
