ProductsSecret Protection

Keep your passwords and keys out of the wrong hands.

Secret Protection stops passwords, API keys and tokens from being saved in your code by mistake. If one has already slipped out, we find it and help you replace it before anyone can use it.

Start for freeTalk to an expert

One copied key can open your whole business.

Developers and AI coding tools paste keys into code all the time to get something working quickly. Once that code is on GitHub, bots can find the key within minutes and use it to read your data or run up your cloud bill.

Leaks caught early, and cleaned up fast.

An API key is a password for a machine. We treat it like one.

Stops leaks at the push

When someone tries to upload code that contains a key, the upload is stopped and they are shown how to fix it.

Finds old leaks

We scan the full history of your code, not just today's version, for keys that were added and later deleted.

Replaces exposed keys

For services like AWS, Stripe, GitHub and Supabase, we can switch off a leaked key and help you issue a new one in a few clicks.

Watches your AI tools

If you build with AI coding assistants, you are warned before a key ends up in a file they wrote.

Checks your live sites

Public websites, app files and preview links are checked for keys that should never be visible to visitors.

Clear next steps

Every finding says where the key is, what it can open and exactly how to move it somewhere safe.

A leak stopped before it leaves the laptop.

Secret Protection checks every upload to GitHub, GitLab and Bitbucket. If it finds a key, the upload is refused with a short message explaining where the key is and how to store it safely instead.

Terminal · acme/web
$ git push origin main
Enumerating objects: 9, done.
remote: BurstLayer stopped this push
remote:   src/lib/s3.ts, line 14
remote:   AWS access key AKIA••••••••7QX2
remote:   Move it to an environment variable,
remote:   then push again. Nothing was uploaded.
 ! [remote rejected] main -> main

Leaked keys, replaced in minutes.

When a key is found, you see what it can access and how long it was exposed. For supported services we switch it off and walk you through issuing a new one, so the old key stops working everywhere.

  • Shows whether anyone else used the key
  • Saves the new key where your app reads it
  • Offers to remove the old key from your code history
AWS access key foundPublic for 2 hours
Where
acme/web · src/lib/s3.ts
It opens
File storage and the billing account
Used by
Nobody else yet. We checked the access log.
  1. Old key switched off at AWS
  2. New key created with the same access
  3. New key saved in your Vercel settings
  4. App redeployed and working

The key still sits in old commits. Remove it from the history too?

Clean history

Three steps to leak-proof code.

  1. 01

    Connect your code

    Link GitHub, GitLab or Bitbucket with read-only access.

  2. 02

    Scan the history

    We check every change ever made for keys, including ones that were later deleted.

  3. 03

    Guard every upload

    New uploads are checked as they happen, so a fresh leak never lands.

Where secrets usually escape.

Blocked

Keys in public code

A key saved in a repository that is public, or becomes public later.

Blocked

Keys in old versions

Deleting a key from your code doesn't remove it from history. Anyone with access can still find it.

Blocked

Keys inside websites

Secret keys bundled into the part of your app that runs in the browser, where any visitor can read them.

Blocked

Database passwords

Connection details for your database copied into code, settings files or tickets.

Blocked

Passwords in logs

Keys accidentally written into log files and error reports that many people can see.

Blocked

Password files shared in chat

Configuration files full of passwords, sent around by chat or email.

Built for the way people code today, AI tools included.

Fast-moving teams and AI assistants make it easy to paste a key where it doesn't belong. We catch it either way.

Questions, answered.

What people usually ask before they turn on Secret Protection.

What counts as a secret?+

Anything that grants access: passwords, API keys, access tokens, private keys and database connection details.

Do you store my secrets?+

No. When we find one, we record where it is and what kind it is, and show only its last few characters. The full secret is never stored.

Which code hosts are supported?+

GitHub, GitLab, Bitbucket and Azure DevOps. Developers can also run the same checks on their own computers with our command-line tool.

What if it's a false alarm?+

Mark it as safe once and it won't be flagged again. Test keys and example values are recognised automatically.

Can you replace keys automatically?+

For services that support it, yes, once you approve it. For others we give you step-by-step instructions.

Works well with

Each product is useful on its own. Together they cover the whole path an attacker would take.

Find out what's already leaked.

Connect your code for free. The first full scan of your history usually takes a few minutes.

Start for freeTalk to an expert