Find secrets across source, artifacts, cloud, and deployed applications.

Install

cargo install --locked keyhog

cargo install --locked keyhog --no-default-features --features portable,gpu

cargo install --locked keyhog --no-default-features --features ci

cargo install --locked --path crates/cli

Then point it at a tree:

keyhog scan .

What a finding looks like

┌    CRITICAL ─── AWS Access Key
│ Secret:       AKIA...JX7Q
│ Location:     infra/terraform/main.tf:142
│ Confidence:   ■■■■■■ 100%
│ Verification: LIVE  (sts:GetCallerIdentity → 200, account 123…)
│ Action:       Revoke immediately and rotate.
└─────────────────────────────────────────────

Every finding names the service, the file and line, a confidence score, and the action to take. Severities run from CRITICAL (a live credential on a paid production account) down to CLIENT-SAFE (a key that is public by design, like a Sentry DSN). Each tier gets its own exit code, so CI can fail on CRITICAL + HIGH without breaking on a key that is meant to ship.

Live verification: which leaks still work

Most scanners stop at the pattern match. Pass --verify and keyhog probes the provider for every detector with a known liveness endpoint, then stamps each finding LIVE, REVOKED, DEAD, or UNVERIFIED. A finding is never silently upgraded.

keyhog scan . --verify

• SSRF-safe by construction. Verifiers cannot be redirected at internal IPs, cannot be aimed at arbitrary hosts, and are rate-limited per vendor.
• Cached and idempotent. Re-scanning the same key hits the verifier cache, not the vendor. A pre-commit hook can verify every commit without spamming the AWS STS quota.
• Separate exit code. exit 10 means one or more LIVE credentials. CI can block a deploy on live keys while letting unverified matches through.

How it avoids false positives

Most of the work in keyhog goes into not firing on things that are not secrets. An AWS access key without its 40-character secret is skipped. Kubernetes Secrets, JWT payloads, and base64-wrapped env files are decoded in place and then scanned, so a key hidden one encoding layer down is still found. Secrets split across lines are reassembled before matching. A key inside a documentation example is reported as documentation, not as a leak.

Built for CI

• SARIF for GitHub Code Scanning. keyhog scan . --format sarif --output keyhog.sarif drops straight into the Security tab via the standard github/codeql-action/upload-sarif step.
• Composite Action. santhreal/keyhog/.github/actions/keyhog@main runs the scanner in CI with SARIF upload and class-separated exit codes.
• Pre-commit. keyhog hook install wires a git pre-commit hook that scans every staged change.
• Daemon mode. keyhog daemon start pays the detector-compilation cost once per host. Every scan after that returns almost instantly, which is what makes per-commit scanning free.
• 9 output formats. Human, JSON, SARIF, and more, plus a live TUI via keyhog tui ..

Fast by default

keyhog routes each scan to the fastest backend on the host: SIMD instructions on the CPU, and on the GPU an Aho-Corasick automaton, which is a state machine that matches all 923 patterns in a single pass over the file. The GPU path runs on Vyre, our GPU compute substrate, and produces bit-identical findings to the CPU path. On a full Linux kernel checkout, a scan finishes in a couple of seconds.

If you are comparing secret scanners

Gitleaks is fast and pattern-only: it finds matches but cannot tell you whether a key still works. TruffleHog verifies credentials but scans on the CPU only. keyhog gives you both halves: service-specific detection with live verification, a GPU-accelerated matching engine, per-severity exit codes for CI gates, and a daemon mode that makes pre-commit scans effectively instant. It is a single static binary, MIT licensed, with no telemetry and no network calls unless you pass --verify.

Get it

github.com/santhreal/keyhog - source, issues, and release notes. Packages on crates.io. The longer architecture writeup is on the blog: Meet keyhog.