KEY/LEAK
Paste a file, .env, CI log or MCP config. Find leaked LLM and cloud keys, see what they can do, rotate in the right order.
✓ Runs in your browser
✓ Network blocked by page policy
✓ Nothing stored, results show redacted values only
Incident watch: LiteLLM 1.107.0 (Oct 21, 2026)
A trojanized LiteLLM 1.107.0 was published to PyPI and Docker on Oct 21. Reported guidance is to pin to 1.106.2 or an earlier release and rotate everything that host could reach. Paste your requirements, lockfile, Dockerfile or compose file below and this page checks for it. Free.
Sources: SOCRadar, The Register. Details may change; check the vendor advisory.
Anything you paste into any chatbot or website other than this one should be treated as exposed. Rotate it.
Why this exists
- Leaked admin AWS key to Bedrock bill: one key was enough to add a user, subscribe to models and run inference on the victim's account (FortiGuard, Sept 2026, via CybersecurityNews).
- GitGuardian's 2026 report counts 28.65M new secrets on public GitHub in 2025, with AI-service secrets up 81% (report).
- Deleting a leaked key from a repo does not revoke it. One summary of the same report says 64% of secrets leaked in 2022 were still active in 2026 (summary).
- MCP config files are a growing leak spot: 24,008 unique secrets found in them on public GitHub, 2,117 still valid (Snyk write-up).