KeyHog
KeyHog is a free, open-source Rust tool for finding exposed secrets in code and other systems.
What KeyHog is
KeyHog is a free, open-source Rust tool for finding exposed secrets in code and other systems. It scans for API keys, tokens, passwords, and credentials across repositories, Git history, containers, cloud storage, browser assets, collaboration content, and running systems. The project describes 934 service-specific detectors, decode-through scanning, contextual evidence and suppression, and optional checks against provider endpoints. Supported sources include archives, Docker images, URLs and HAR captures, VCS inventories, and S3, GCS, and Azure Blob inventories. Its GitHub Action scans a checked-out tree, fails on high or critical findings, uploads SARIF to Code Scanning, and retains an artifact; documented CI options also include GitLab, CircleCI, Jenkins, Buildkite, and shell jobs. A Unix daemon can check changed repository blobs before commits, while Windows uses in-process scanning. KeyHog supports CUDA, native Metal, and portable WGPU execution. It runs on Linux, macOS, Windows, and self-hosted environments, and requires Rust 1.89 or newer. Live verification sends credential-derived requests to provider endpoints, and not every detector supports it. Plain directory scans omit native binaries unless users enable the binary option and use a build with that feature.
Good
- 934 service-specific detectors are listed.
- Supports CI and pre-commit scanning.
- Scans repositories, containers, cloud inventories, and more.
- Free and open source under MIT or Apache-2.0.
- Runs on Linux, macOS, and Windows.
Watch out
- Requires Rust 1.89 or newer.
- Plain directory scans do not inspect native binaries.
- Not every detector supports live verification.
- Live verification sends credential-derived requests to providers.
Who it suits
KeyHog suits developers and security teams scanning repositories, CI pipelines, cloud inventories, and other listed sources for exposed credentials. It is also relevant to teams able to meet its Rust version requirement and configure scanning limits deliberately.
Verdict
KeyHog offers broad secret scanning and CI integrations as a free open-source tool, but binary scanning and live verification have explicit limits. Review the build requirements and endpoint behavior before enabling those modes.
Plans and prices
From KeyHog's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| KeyHog | Free | Open-source · MIT OR Apache-2.0 · install via crates.io |
The facts
Each one read from KeyHog's own pages, with the date it was checked.
What it does
- CI integration
- The GitHub Action scans a checked-out tree, fails on high or critical findings, uploads SARIF to Code Scanning, and retains a workflow artifact.checked 9 Oct 2026
- Detection
- The repository describes 934 service-specific detectors, decode-through scanning, context-aware evidence and suppression, and optional live provider verification.checked 9 Oct 2026
- GPU backends
- KeyHog supports CUDA, native Metal, and portable WGPU execution, with calibration that routes to a parity-proven backend.checked 9 Oct 2026
- License
- The code and detector TOMLs are dual-licensed MIT OR Apache-2.0, and the repository permits commercial use, embedding, forks, and hosted services under either license.checked 9 Oct 2026
- Local guard
- KeyHog can run a Unix daemon to check changed repository blobs for pre-commit secret detection; on Windows the documented alternative is in-process scanning.checked 9 Oct 2026
- Other CI
- The project documents CI use with GitLab, CircleCI, Jenkins, Buildkite, and generic shell jobs.checked 9 Oct 2026
- Purpose
- KeyHog is an open-source Rust secret scanner that finds and verifies leaked API keys, tokens, passwords, and credentials across code, Git history, containers, cloud storage, browser assets, collaboration content, and running systems.checked 9 Oct 2026
- Scan limit
- A plain directory scan does not inspect native binaries; users must pass `--binary` and use a build with the binary feature.checked 9 Oct 2026
- Scanning sources
- Documented sources include repositories and Git history, archives, Docker images, URLs and HAR captures, GitHub collaboration content, GitHub/GitLab/Bitbucket inventories, and S3/GCS/Azure Blob inventories.checked 9 Oct 2026
- Security behavior
- Endpoint fetching is bounded and SSRF-screened, while private cloud endpoints and credential forwarding require explicit trust flags.checked 9 Oct 2026
- Security reporting
- The maintainer asks users to report security issues through GitHub private vulnerability reporting or email [email protected].checked 9 Oct 2026
- System requirement
- KeyHog requires Rust 1.89 or newer.checked 9 Oct 2026
- Telemetry
- The documented performance report omits source content, credential values, raw paths, raw URLs, and raw configuration values.checked 9 Oct 2026
- Verification limit
- Live verification sends credential-derived requests to provider endpoints, and the repository states that not every detector supports verification.checked 9 Oct 2026
Alternatives to KeyHog
- 1
DeepSource
Free planWebAPILinuxmacOS8.0From $30 a month - 2
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 3
Vooda AI
Free planWebAPILinuxmacOS6.9Free plan - 4
Arnica Secrets Security
Free planWebAPISelf-hosted6.6From $300 a year - 5
GitGuardian
Free planWebAPILinuxmacOS6.6Free plan - 6
detect-secrets
Free planLinuxmacOSSelf-hostedWindows6.5Free plan