amal-david/KeyLeak Detector
Scan for exposed API keys, BaaS misconfigurations (Supabase RLS, Firebase rules), and secrets in your codebase and preview deployments. Supports local file scanning, browser-based scanning of live URLs, and BaaS active validation.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 8, 2026
- License
- MIT
Pinned Snippet
uses: amal-david/keyleak-detector@c3c2e4e2754824b6d177e9fe54e978e7d4452657 # v0.6.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | Scan mode: local (files only), browser (live URL), or both. | no | local |
| url | URL to scan in browser mode (e.g., preview deployment URL). | no | "" |
| baas-validate | Enable active BaaS validation probes (Supabase RLS, Firebase rules). | no | false |
| fail-on | Severity threshold to fail the check (low|medium|high|critical). | no | high |
| launch-profile | Launch profile (launch-gate|local-dev|bug-bounty|ci|full). | no | ci |
| allowlist | Path to allowlist (.yaml or .txt). | no | keyleak-allowlist.yaml |
| output-format | Output format: json, sarif, markdown, or html. | no | json |
| python-version | Python version for the runner. | no | 3.12 |
Outputs
| name | description |
|---|---|
| verdict | Scan verdict: SAFE_TO_SHIP, REVIEW, or BLOCK_SHIP |
| findings-count | Total number of findings |
| report-path | Path to the generated report file |