Skip to content
SPECIFICTION
Get listed

KeyHog

github.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 7.7 #14 of 24 in Secrets Scanning Software

What it is

KeyHog is free, open-source Rust software for finding and verifying exposed API keys, tokens, passwords, and other credentials. It scans source repositories and Git history, archives, Docker images, URLs and HAR captures, collaboration content, VCS inventories, cloud-storage inventories, browser assets, and running systems. The project lists 934 service-specific detectors, decode-before-scanning, contextual evidence and suppression, and optional live provider verification. GPU execution can use CUDA, native Metal, or portable WGPU, with calibration selecting a parity-backed option. Its GitHub Action scans checked-out trees, fails on high or critical findings, uploads SARIF to Code Scanning, and retains a workflow artifact. Documented CI integrations include GitLab, CircleCI, Jenkins, Buildkite, and shell jobs. A Unix daemon checks changed repository blobs before commits; Windows uses in-process scanning. KeyHog runs on Linux, macOS, Windows, and self-hosted deployments, and requires Rust 1.89 or newer. Code and detector TOMLs are licensed MIT OR Apache-2.0. The plan costs nothing.

Spec sheet

Purpose
KeyHog is an open-source Rust secret scanner that finds and verifies leaked API keys, tokens, passwords, and credentials across code, Git history, containers, cloud storage, browser assets, collaboration content, and running systems.Read 9 Oct 2026 · github.com
License
The code and detector TOMLs are dual-licensed MIT OR Apache-2.0, and the repository permits commercial use, embedding, forks, and hosted services under either license.Read 9 Oct 2026 · github.com
CI integration
The GitHub Action scans a checked-out tree, fails on high or critical findings, uploads SARIF to Code Scanning, and retains a workflow artifact.Read 9 Oct 2026 · github.com
Detection
The repository describes 934 service-specific detectors, decode-through scanning, context-aware evidence and suppression, and optional live provider verification.Read 9 Oct 2026 · github.com
GPU backends
KeyHog supports CUDA, native Metal, and portable WGPU execution, with calibration that routes to a parity-proven backend.Read 9 Oct 2026 · github.com
Local guard
KeyHog can run a Unix daemon to check changed repository blobs for pre-commit secret detection; on Windows the documented alternative is in-process scanning.Read 9 Oct 2026 · github.com
Other CI
The project documents CI use with GitLab, CircleCI, Jenkins, Buildkite, and generic shell jobs.Read 9 Oct 2026 · github.com
Scan limit
A plain directory scan does not inspect native binaries; users must pass `--binary` and use a build with the binary feature.Read 9 Oct 2026 · github.com
Scanning sources
Documented sources include repositories and Git history, archives, Docker images, URLs and HAR captures, GitHub collaboration content, GitHub/GitLab/Bitbucket inventories, and S3/GCS/Azure Blob inventories.Read 9 Oct 2026 · github.com
Security behavior
Endpoint fetching is bounded and SSRF-screened, while private cloud endpoints and credential forwarding require explicit trust flags.Read 9 Oct 2026 · github.com
Security reporting
The maintainer asks users to report security issues through GitHub private vulnerability reporting or email [email protected].Read 9 Oct 2026 · github.com
System requirement
KeyHog requires Rust 1.89 or newer.Read 9 Oct 2026 · github.com
Telemetry
The documented performance report omits source content, credential values, raw paths, raw URLs, and raw configuration values.Read 9 Oct 2026 · github.com
Verification limit
Live verification sends credential-derived requests to provider endpoints, and the repository states that not every detector supports verification.Read 9 Oct 2026 · github.com

Plans and prices

KeyHog Free Open-source · MIT OR Apache-2.0 · install via crates.io Read 9 Oct 2026 · github.com

Every KeyHog plan and price →

Strong points and limits

Strong points

  • 934 service-specific detectors
  • Scans repositories, containers, cloud inventories, and collaboration content
  • GitHub Action uploads SARIF and fails on severe findings
  • Supports CUDA, Metal, and WGPU execution
  • MIT OR Apache-2.0 licensing permits commercial use

Limits

  • Requires Rust 1.89 or newer
  • Plain directory scans skip native binaries without extra options
  • Not every detector supports live verification
  • Verification sends credential-derived requests to providers

Who it suits

It suits development and security teams scanning repositories, CI pipelines, containers, cloud inventories, and collaboration sources for leaked credentials. It also fits teams needing pre-commit checks, pull-request scanning, or self-hosted operation.

Verdict

KeyHog offers broad secret-scanning coverage across development, cloud, and collaboration sources, with CI and pre-commit workflows. Its documented limits around binaries and detector verification should shape deployment plans.

Where Specifiction places it

Alternatives to KeyHogAll alternatives →