Keyscan

Built with [Operator Memory](https://github.com/aerovato/operator-memory)

Keyscan

Keyscan: LLM-powered API key scanner.

Keyscan searches public GitHub Gists for exposed API keys and helps surface potential exposures for further review. It uses GitHub's web search pages to locate candidate gists, fetches gist contents via the GitHub API, and calls an OpenAI-compatible chat completions endpoint to classify whether a value looks like an API key. When a likely exposure is found, the project saves a structured record and prepares a user-facing message to notify the gist owner.

This repository is intended as a research / defensive tool to help users find and remediate accidentally exposed credentials. Do not use Keyscan to access, exfiltrate, or otherwise misuse credentials that do not belong to you. See the terms of use below.

Features

• Scan entire lists of keywords.
• Bring your own LLM model and customizable prompts for classification.
• Configurable file types.
• Optional GitHub token support for increased rate limits.
• Verification of discovered values against provider endpoints when possible.
• Structured output saving for manual review.

Installation

1. Clone the repository:

git clone https://github.com/aerovato/keyscan.git
cd keyscan

# OR, if project directory already created:
git clone https://github.com/aerovato/keyscan.git .

1. (Recommended): Create and activate a virtual environment:

python -m venv .venv
source .venv/bin/activate

1. Install dependencies:

pip install -r requirements.txt

1. Configure application settings. Copy config.py.example to config.py and update values as needed.

GITHUB_TOKEN = "ghp_..." # GitHub Token for increased API rate limits
GITHUB_SESSION_COOKIE = "..." # Optional: GitHub session cookie for HTML requests

LLM_BASE_