leakkill

Leaked a key? Find it, see if it's live, and kill it in one command. Free, local, zero dependencies.

Free tools are great at finding secrets. What happens after a leak is usually left to paid platforms: is this key still working, whose account is it, how do I revoke it right now, and how do I clean it out of git history? leakkill does that part too, from your terminal, for free.

$ leakkill verify
#1   LIVE         GitHub token           ghp_************     config.py:3
      octocat  scopes: repo, workflow
#2   DEAD         AWS access key         AKIA************     deploy/old.sh:12
      key id is unknown or deactivated
#3   UNVERIFIABLE Credentials in URL     postgres://app:****@db.prod.internal  .env.backup:1

3 unique secret(s), 1 LIVE.

$ leakkill revoke --only 1 --yes
  #1 GitHub token: REVOKED (HTTP 202)

Install

pip install leakkill

Python 3.9+, no dependencies. Latest development version: pip install git+https://github.com/ayushanand27/leakkill

Commands

Every scan command also accepts --staged (pre-commit), --history (every commit on every branch, including secrets you already "deleted"), --exclude-tests and --json.

What it can verify and revoke

How it compares

Detector and pricing figures come from public sources in October 2026. Use what fits your needs: if breadth of detection matters most, run Gitleaks or TruffleHog alongside leakkill.

Tested with real credentials

End to end on Windows with real, throwaway credentials:

Against the real AWS, GitLab, Anthropic and npm APIs, invalid keys are correctly reported DEAD. Providers not yet tested with a live key (OpenAI, OpenRouter, Groq, Replicate, DigitalOcean, SendGrid, Telegram) are covered by tests using simulated API responses.

Benchmark (reproducible, run October 2026)

Noise on clean, popular repos (unique secrets reported, default settings):

Recall on 17 planted realistic secrets: leakkill 17/17, Gitleaks 14/17. Gitleaks missed a Postgres URL with a password, a Discord webhook and a Telegram bot token. The planted set was written by us, so it is biased toward formats we support. Gitleaks detects many formats we don't.

Safety model

• scan never touches the network.
• A secret is only ever sent to the provider that issued it. Hosts are hard-coded, and HTTP redirects are never followed, so a credential can't be bounced to another server (this is tested).
• Verification uses read-only identity calls: GitHub GET /user, Slack auth.test, AWS GetCallerIdentity and so on.
• revoke is a dry run unless you pass --yes, and only touches keys that verified as live.
• Raw secrets are never printed or written to the report. The only exception is the opt-in report --replacements FILE (needed by git filter-repo), which is created with permissions 600.

Cleaning git history

leakkill revoke --history --yes                 # 1. kill live keys first: history rewrites don't help once copied
pip install git-filter-repo
leakkill report --history --replacements .leakkill-replacements.txt
git filter-repo --replace-text .leakkill-replacements.txt
rm .leakkill-replacements.txt
git push --force --all && git push --force --tags  # every collaborator must re-clone

AI coding agent guard (Claude Code)

leakkill install-claude-hook adds hooks to .claude/settings.json that block:

• prompts that contain secrets (before they reach the model)
• reading .env, *.pem, id_rsa, .npmrc and similar, whether through the Read tool or any shell command that names such a file (cat, grep, base64, python -c, cp …). .env.example is allowed.
• writing hard-coded keys into code (writing them into .env is allowed)

This was tested live with the Claude Code CLI: prompts with keys, Read .env, cat .env, grep . .env and writing an AWS key into app.py were all blocked. The check is pattern-based: a command that builds the file name at runtime can get past it. Pair it with OS-level permissions for hard guarantees.

Use in CI (GitHub Action)

- uses: actions/checkout@v4
- uses: ayushanand27/leakkill@v0

The build fails if a secret is found, and the incident report appears in the job summary. Options:

- uses: ayushanand27/leakkill@v0
  with:
    path: .               # files or directories to scan
    exclude-tests: true   # skip test_* files and tests/ dirs
    history: true         # scan every commit (needs `fetch-depth: 0` on checkout)
    verify: true          # check secrets with their providers; fail only if one is LIVE

The action exposes found (the number of unique secrets) as an output. Outside GitHub Actions, use pip install leakkill && leakkill scan ..

Use with the pre-commit framework

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/ayushanand27/leakkill
    rev: v0.3.0
    hooks:
      - id: leakkill

Or without the framework: leakkill install-hook.

Suppressing false positives

• Add leakkill:ignore on a line.
• List paths or globs in .leakkillignore (for example fixtures/ or *.snap).
• High-entropy matches ignore placeholders (your_key, example, ${VAR}), variables named test/example/fake/mock, password hashes and values without digits.

Known limitations

• Fewer detectors than Gitleaks or TruffleHog.
• Verification behind a proxy that injects its own credentials (some corporate and sandbox proxies do) can report the proxy's identity. Run verify from a normal network.
• AWS keys can only be verified when the secret key is found too (any file in the scan).
• Stripe, OpenAI, Anthropic, npm and Telegram offer no revoke API, so those need a manual click.

MIT licensed.