Interactive demo — synthetic data, read-only. Nothing here is a real person or organisation. Request access →

Secrets & keys

API keys, cloud secrets and connection strings our scanner pulled from the downloaded files — categorized and risk-rated. AD/LDAP & database connections are flagged critical. Every source links to its file and machine.

18 secrets 6 critical 6 high 15 corporate 0 personal 9 confirmed live 14 machines

All categories 🐙 Git repo keys 3 🪣 S3 / cloud storage secrets 3 ☁️ Cloud & SaaS keys 3 ✉️ SMTP / email keys 3 🗄️ Database connections 3 💳 Payment provider keys 3

Risk	Category	Secret	Host / user	Ownership	Source	Status
critical	💳 Payment provider keys stripe	sk********	mail.northwind-logistics.e... svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	invalid
critical	🐙 Git repo keys github	gh********	vpn.northwind-logistics.ex... svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	✓ live
critical	💳 Payment provider keys stripe	sk********	citrix.globex-financial.ex... svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	✓ live
critical	🐙 Git repo keys github	gh********	finance.globex-financial.e... svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	✓ live
critical	💳 Payment provider keys stripe	sk********	git.acme-corp.example svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	✓ live
critical	🐙 Git repo keys github	gh********	citrix.acme-corp.example svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	✓ live
high	✉️ SMTP / email keys sendgrid	SG********	remote.northwind-logistics... svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	✓ live
high	🪣 S3 / cloud storage secrets aws	AK********	sso.northwind-logistics.ex... svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	invalid
high	✉️ SMTP / email keys sendgrid	SG********	git.globex-financial.examp... svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env
high	🪣 S3 / cloud storage secrets aws	AK********	api.globex-financial.examp... svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	invalid
high	✉️ SMTP / email keys sendgrid	SG********	git.acme-corp.example svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	✓ live
high	🪣 S3 / cloud storage secrets aws	AK********	sso.acme-corp.example svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	invalid
medium	🗄️ Database connections	my********	git.northwind-logistics.ex... svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	invalid
medium	🗄️ Database connections	my********	admin.globex-financial.exa... svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	invalid
medium	🗄️ Database connections	my********	api.acme-corp.example svc-deploy	🏢 corporate	🖥️ machine · 📄 config.env	invalid
medium	☁️ Cloud & SaaS keys google	AI********	api.northwind-logistics.ex... svc-deploy	—	🖥️ machine · 📄 config.env	✓ live
medium	☁️ Cloud & SaaS keys google	AI********	owa.globex-financial.examp... svc-deploy	—	🖥️ machine · 📄 config.env	invalid
medium	☁️ Cloud & SaaS keys google	AI********	vpn.acme-corp.example svc-deploy	—	🖥️ machine · 📄 config.env	✓ live

⚖️ Validation runs client-side, never from this server. Click validate ⚡: for provider API keys (Google/AWS/Stripe/SendGrid/Slack/GitHub) the check runs in your browser where CORS allows; for raw-socket services (AD/LDAP, DB, FTP, SMTP, MQTT) and remote-access "connect" files (RDP/VNC/SSH/AnyDesk/TeamViewer) — which a browser can't open — you get the exact command to run from an authorized position on the client network, then record the outcome. Only validate targets you are authorized to test. Results (live / rejected / unreachable) are saved with a timestamp and the method used.