gshark

gshark watches public code for your secrets before someone else finds them. It scans GitHub, GitLab, Searchcode, and Postman for leaked API keys, tokens, and credentials that match rules you define, then surfaces the hits in a web dashboard. The job it does is the same one GitGuardian charges for: catching the AWS key an employee pasted into a public gist before it turns into a bill or a breach. It is open source under Apache-2.0.

This is a real application to run, not a script. There is a Go backend, a Vue frontend, and a database, plus API tokens for each source you want to scan. Budget an afternoon to stand it up and some ongoing care to tune rules so you are not drowning in false positives. Once it is running, it is yours: your data never leaves your infrastructure, which matters when the thing you are searching for is your own leaked credentials.

Solo developers and small teams who mostly need to watch their own org: gshark is a solid free option and the self-hosting is manageable. Larger security teams that want managed coverage, validity checking, and a support line will still find GitGuardian or similar worth paying for. If you only need to scan your own repos in CI, lighter tools like gitleaks or trufflehog may be a better fit than standing up a whole platform.

The catch: a tool that hunts for exposed secrets across public code is dual-use by nature, and the docs lean heavily Chinese. Nothing wrong with either, but factor in the reading and the responsibility before you point it at the whole internet.