Find published secrets across six public artifact sources

Scans GitHub repositories plus npm, PyPI, Docker Hub, Hugging Face and Postman public workspaces and collections for secrets already published against your domain. Secrets ship inside released packages and images constantly, and repo-only scanners never see them. Every hit is verified against the matching credential pattern before it is reported, so a docs example or a placeholder is not billed to you as a CRITICAL.

Billing. $0.35 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

Note. Artifact discovery runs under a 75-second budget. If it is exhausted, remaining sources are skipped and coverage[].sources reports exactly what ran -- reduced coverage is stated rather than returned as a false all-clear. A partial scan is never cached, so a rate-limited moment cannot be frozen in as a 24-hour clean result.