Find the secrets leaked in your code before someone else does.

Install

cargo install keyhog

curl -fsSL https://santh.dev/keyhog/install.sh | sh

iwr https://santh.dev/keyhog/install.ps1 -useb | iex

git clone https://github.com/santhreal/keyhog && cd keyhog && cargo build --release

Then point it at a tree:

keyhog scan .

What a finding looks like

┌    CRITICAL ─── AWS Access Key
│ Secret:       AKIA...JX7Q
│ Location:     infra/terraform/main.tf:142
│ Confidence:   ■■■■■■ 100%
│ Verification: LIVE  (sts:GetCallerIdentity → 200, account 123…)
│ Action:       Revoke immediately and rotate.
└─────────────────────────────────────────────

Every finding names the service, the file and line, a confidence score, and the action to take. Severities run from CRITICAL (a live credential on a paid production account) down to CLIENT-SAFE (a key that is public by design, like a Sentry DSN). Each tier gets its own exit code, so CI can fail on CRITICAL + HIGH without breaking on a key that is meant to ship.

Live verification: which leaks still work

Most scanners stop at the pattern match. Pass --verify and keyhog probes the provider for every detector with a known liveness endpoint, then stamps each finding LIVE, REVOKED, DEAD, or UNVERIFIED. A finding is never silently upgraded.

keyhog scan . --verify

• SSRF-safe by construction. Verifiers cannot be redirected at internal IPs, cannot be aimed at arbitrary hosts, and are rate-limited per vendor.
• Cached and idempotent. Re-scanning the same key hits the verifier cache, not the vendor. A pre-commit hook can verify every commit without spamming the AWS STS quota.
• Separate exit code. exit 10 means one or more LIVE credentials. CI can block a deploy on live keys while letting unverified matches through.

Why it does not cry wolf

A scanner that fires on everything gets switched off. keyhog keeps false positives down with companion-required validation (an AWS access key without its 40-char secret is skipped), decode-through scanning (Kubernetes Secrets, JWT payloads, base64-wrapped envs are decoded in place, then scanned), multiline reassembly for secrets split across lines, and context-aware suppression for keys inside documentation and examples.

Built for CI

• SARIF for GitHub Code Scanning. keyhog scan . --format sarif --output keyhog.sarif drops straight into the Security tab via the standard github/codeql-action/upload-sarif step.
• Composite Action. santhreal/keyhog/.github/actions/keyhog@main runs the scanner in CI with SARIF upload and class-separated exit codes.
• Pre-commit. keyhog hook install wires a git pre-commit hook that scans every staged change.
• Daemon mode. keyhog daemon start pays the detector-compilation cost once per host. Every scan after that returns almost instantly, which is what makes per-commit scanning free.
• 9 output formats. Human, JSON, SARIF, and more, plus a live TUI via keyhog tui ..

Fast by default

keyhog routes each scan to the fastest backend on the host: SIMD on the CPU, and an Aho-Corasick automaton on the GPU when a file is large enough to be worth the dispatch. The GPU path runs on Vyre, our GPU compute substrate, and produces bit-identical findings to the CPU path. On a full Linux kernel checkout, a scan finishes in a couple of seconds.

If you are comparing secret scanners

Gitleaks is fast and pattern-only. TruffleHog verifies credentials but scans on the CPU. keyhog gives you both halves: service-specific detection with live verification, plus a GPU-accelerated matching engine, per-severity exit codes, and a daemon mode that makes pre-commit scans effectively instant. Single static binary, MIT licensed, no telemetry, no network calls unless you pass --verify.

Get it

github.com/santhreal/keyhog - source, issues, and release notes. Packages on crates.io. The longer architecture writeup is on the blog: Meet keyhog.