Secret Scanner API

Scan text (code, config, logs, .env files) for leaked secrets such as AWS keys, GitHub and Stripe tokens, private keys, JWTs and passwords in URLs. Findings carry line, column, severity and a masked preview, never the raw secret.

POST /api/v1/tools/secret-scannerMCP secret_scannerSecurity & Privacy

Paste logs, .env or config files to find leaked API keys, tokens, private keys and passwords, then copy a masked copy that is safe to share. Runs in your browser.

Input

Send these as a JSON object. Unknown fields are rejected.

input: The text to scan. (string, required)
includeLow: Include low-severity findings such as publishable keys and account IDs. (boolean, default true)
masked: Also return the whole input with every secret replaced by its masked preview. (boolean, default false)

Try it in the browser JSON Schema Get an API key

curl https://pithlab.com/api/v1/tools/secret-scanner \n  -H "Authorization: Bearer $PITHLAB_KEY" \n  -H "Content-Type: application/json" \n  -d '{"input":"AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE\nDATABASE_URL=postgres://app:Xk9#[email protected]:5432/app\nDEBUG=false"}'

Example response

{
  "ok": true,
  "result": {
    "total": 2,
    "bySeverity": {
      "critical": 0,
      "high": 2,
      "medium": 0,
      "low": 0
    },
    "findings": [
      {
        "ruleId": "aws-access-key-id",
        "type": "AWS access key ID",
        "severity": "high",
        "line": 1,
        "column": 19,
        "masked": "AKIA****MPLE",
        "advice": "Deactivate the key in AWS IAM and check CloudTrail for use. The ID alone is not enough to sign requests, but it usually travels with its secret."
      },
      {
        "ruleId": "connection-string",
        "type": "Connection string with password",
        "severity": "high",
        "line": 2,
        "column": 29,
        "masked": "****",
        "advice": "Change the database or service password and load it from a secret store instead."
      }
    ]
  }
}