Hey devs ๐
I'm Zaim โ a backend engineer and student, currently diving deep into LLM security.
A few weeks ago, I was just messing around with GitHub dorks.
You know... the usual:
filename:.env
"sk-" in files pushed last week
Stuff like that.
What I didnโt expect was how many live API keys Iโd find.
I'm talking:
OpenAI keys (some still active ๐)
Claude / Anthropic keys
Google Cloud API tokens
and even internal test keys from private orgs that somehow made it into public repos.
Some had been sitting there for weeks. No revokes. No alerts. Justโฆ exposed.
So I built a tool.
Out of curiosity (and lowkey horror), I spun up a crawler and scanner.
It now continuously monitors public GitHub in real time, flagging leaked keys from:
OpenAI
Claude / Anthropic
Gemini / Google
and more...
It turned into a project I call API Radar.
Itโs a public dashboard showing:
โ
Real-time leaked API keys
โ
Redacted + raw views
โ
Security leaderboard
โ
Filters by provider
โ
Timeline of exposure
What Iโve seen so far:
๐ฆ 9,200+ public repos scanned
๐ 250+ exposed API keys found
โฑ๏ธ First leak spotted within 5 minutes of going live
๐ Keys from projects across Pakistan, US, EU, and more
Some people are literally pushing .env files with live keys and leaving them for days.
Others try to hide them in random config folders, but GitHubโs searchโฆ doesnโt miss.
Why it matters
If youโre in security, LLMs, or open source, this matters.
If you're a student, bug bounty hunter, or just curious โ this is an underrated goldmine for learning how bad hygiene actually looks in the wild.
It made me rethink how easy it is to mess up API key security โ even for big teams.
Iโm not trying to sell anything here.
Just want to ask:
Would this help you in CTFs / bug bounties / red teaming?
What else should I track or visualize?
Should I open the scanner as a public API too?
Let me know โ curious what the community thinks ๐
Top comments (1)
Got curious? You can play with the keys here: apiradar.live/