API Radar – Real-Time GitHub Scanner for Exposed API Keys

TL;DR

TL;DR: API Radar scans public GitHub repositories in real time, alerting you when API keys are exposed so you can act before attackers exploit them.

Source and Accuracy Notes

• Official site: apiradar.live
• GitHub: github.com/apiradar

What Is API Radar?

API Radar is a real-time scanning platform that monitors public GitHub repositories for exposed API keys and secrets. It tracks exposure trends across millions of repos, giving security teams and developers immediate visibility into where credentials are being leaked.

Unlike manual secret scanning (which is reactive and per-repo), API Radar runs continuous monitoring across the public GitHub corpus. When a key matching a known pattern is found in a public commit, you get an alert with context: which provider, which repo, when it was exposed, and severity.

Setup Workflow

Step 1: Sign Up

Visit apiradar.live and create a free account. The dashboard gives you immediate access to the live feed of detected exposures.

Step 2: Connect Your GitHub

Link your GitHub account or organization to start monitoring your own repositories for accidental secret commits. This works alongside the public repo scanning.

Step 3: Configure Alert Rules

Set up alert channels (email, Slack, webhooks) for specific key types or providers. You can filter by:

• Key provider (AWS, Stripe, GitHub, OpenAI, etc.)
• Repository owner or organization
• Exposure age (newly exposed vs. long-standing)

Deeper Analysis

How the Scanning Works

API Radar uses pattern matching against known secret formats for major providers, combined with entropy analysis to catch novel credentials. The scanning runs continuously against the public GitHub event stream.

What You Get in the Dashboard

• Live Feed — Real-time stream of detected exposures across all monitored repos
• Trend Charts — Exposure volume by provider over time
• Repo Drill-down — Which repos are leaking, how many keys, for how long
• Remediation Guidance — Each alert includes steps to revoke and rotate the affected key

Pricing

API Radar offers a free tier with limited scanning volume. Paid plans unlock higher monitoring limits, more alert channels, and historical trend data. Check apiradar.live/pricing for current tiers.

Practical Evaluation Checklist

• Does the free tier give enough to evaluate the core scanning capability?
• Are the alert channels you need (Slack, webhook, email) supported?
• Is the false positive rate manageable?
• Does the dashboard give you actionable context per alert, or just a raw match?
• Can you integrate it into a CI/CD pipeline for pre-commit scanning?

Security Notes

• API Radar scans public GitHub repositories only. Private repo scanning requires connecting your GitHub account.
• Keys detected in public commits should be considered compromised immediately — revoke and rotate.
• The platform does not automatically revoke keys; it alerts you so you can take action.

FAQ

Q: Does API Radar scan private repositories? A: No — it scans public GitHub repositories. To monitor private repos, you would need a different secret scanning tool that runs in your CI pipeline or IDE.

Q: How does API Radar access GitHub repos? A: It uses the public GitHub event stream and public repo access. No special GitHub API token is required for the public scanning.

Q: Can I integrate API Radar into my CI/CD pipeline? A: API Radar is primarily a monitoring platform for already-exposed secrets. For pre-commit or pre-deploy secret scanning, you would use a tool like Gitleaks or GitHub’s native secret scanning alongside API Radar.

Q: What providers does it detect? A: It supports a wide range of providers including AWS, Stripe, GitHub, OpenAI, Google Cloud, Twilio, Slack, and many others. The full list is on the site.

Conclusion

API Radar fills a specific gap: catching secrets that have already been exposed in public GitHub repos before attackers can exploit them. It is not a replacement for pre-commit scanning, but it is a valuable layer of real-time monitoring for any organization with developers who accidentally commit keys.

Bookmark it at apiradar.live and set up alerts for your key providers.