KeySentry
A free tool that goes through a GitHub repository looking for accidentally-committed passwords, API keys, and sensitive files — the digital equivalent of checking your pockets before publishing.
🔗 Visit KeySentry
Description
Committing a secret to a public GitHub repo happens more often than teams like to admit — a stray .env file, a hardcoded AWS key, an SSH private key copied in by mistake. KeySentry scans a GitHub repo or a local folder for over 25 common API key formats (AWS, Slack, Stripe, OpenAI, and others), using both regex pattern matching and entropy analysis to catch keys that don't match a known format but still look random enough to be a real secret. It also flags sensitive files by name, like .env, id_rsa, or firebase.json.
It's free and open source under the MIT license, usable via a command-line interface or a web-based frontend hosted on Netlify, with Docker support for teams that want it in a container. It outputs structured JSON for piping into other tools and ships with YARA detection rules for more advanced pattern matching.
💬 Our review
The short version: this is a straightforward, no-cost safety net for exactly the mistake it's built to catch — free, open source, and simple enough to run before every push without much setup.
It covers similar ground to well-known scanners like GitLeaks or TruffleHog (KeySentry itself doesn't claim to be more comprehensive), but its main appeal is accessibility: a web frontend for people who don't want to install a CLI, plus Docker support for those who do. If you already run GitLeaks or TruffleHog in CI, KeySentry doesn't add much beyond what they cover; if you're looking for a quick, free, zero-friction check — especially via the web UI — it's an easy option with no real downside since there's no cost.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Licence MIT, disponible en CLI, interface web (Netlify) et Docker.
Pros
25+ formats de clés API détectés, détection par entropie en plus des regex
Interface web en plus du CLI — zéro installation nécessaire
Gratuit, open source, support Docker
Cons
Couverture globalement similaire à GitLeaks/TruffleHog, peu d'avantage si déjà équipé
Outil communautaire de niche, pas de garantie de maintenance long terme
Interface web hébergée par un tiers (Netlify) — vérifier les implications de confidentialité