APIRadar – Real-Time API Key Exposure Scanner

TL;DR

TL;DR: APIRadar is a real-time monitoring tool that scans public GitHub repositories for exposed API keys, giving security teams immediate visibility into credential leaks across OpenAI, Claude, Gemini, and other major providers.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: apiradar.live ← verified via direct fetch
• Source repository: no public source code repository (proprietary scanning platform)
• License: proprietary (commercial SaaS)
• HN launch thread: news.ycombinator.com/item?id=44720248 ← objectID from HN Algolia
• Source last checked: 2026-06-25

What Is APIRadar?

APIRadar is a real-time GitHub scanner that detects exposed API keys across public repositories. Built by Zaim Abbasi, it monitors millions of GitHub repos to surface credential leaks for major providers — OpenAI, Google Cloud, Gemini, and more — as they happen.

The platform indexes new commits continuously, so a leaked key can appear in search within minutes of being pushed. Each exposure record includes the provider, a redacted version of the key (so you cannot reuse it), the repository reference, and a timestamp.

Key capabilities

From the product page, APIRadar surfaces the following forensic data points per exposure:

• Provider — which service issued the exposed key (e.g. OpenAI, Claude, Google Cloud)
• Redacted Key — the key prefix and suffix with the middle portion masked, sufficient to identify the specific credential without enabling reuse
• Repository — the GitHub repository where the leak occurred
• Timestamp — when the commit containing the key was pushed
• Repository Reference — deep link to the specific commit or file

This gives security teams a live feed of credential exposure events across the entire public GitHub landscape.

Who is it for?

APIRadar targets three audiences:

• Individual developers who want to check whether their own keys have leaked
• Security teams monitoring organizational exposure across open-source dependencies and internal repositories that were accidentally made public
• Enterprise security awareness programs using real-world metadata to build defensive training without ever touching the original source code

How APIRadar Works

APIRadar does not clone repositories or store code. It scans commit metadata and diffs for high-confidence API key patterns — the same signatures that GitHub’s own secret scanning uses, but surfaced in a searchable, filterable interface with trend analysis.

Exposure analysis workflow

1. Live scanning — new public commits are indexed continuously across all reachable repositories
2. Pattern matching — provider-specific key signatures are matched (e.g. sk- for OpenAI, AIza for Google)
3. Redaction — only redacted previews are stored; the actual secret is never exposed in the UI or stored in plaintext
4. Forensic enrichment — each alert is tagged with provider, repository owner, timestamp, and repository reference
5. Trend analysis — exposure trends are visualized so teams can identify which providers or which code patterns generate the most leaks

Privacy guarantee

The platform explicitly states it never clones or retains source code. All analysis operates on metadata and pattern signatures only.

Security Analysis

Why real-time API key scanning matters

API keys pushed to public GitHub repositories are typically harvested by automated botnets within minutes of being committed. By the time a developer realizes and revokes the key, it has often already been used — either for free-tier abuse or, in the case of cloud provider keys, for infrastructure compromise.

GitHub’s own secret scanning catches many of these leaks, but it is a reactive, opt-in feature that requires repository owners to enable it. APIRadar operates at a broader scope across the entire public repository surface.

Strengths

• Real-time indexing provides much faster detection than periodic scans
• Redacted key display prevents the tool from being a key-harvesting service itself
• Provider-level categorization makes it easy to triage by risk and blast radius
• Repository reference links allow security teams to coordinate with affected repository owners

Limitations

• Only covers public repositories — private repo exposure is out of scope
• APIRadar is a proprietary SaaS platform; the scanning engine is not open source, so the community cannot audit the detection logic or contribute new provider signatures
• There is no free self-hosted option — the tool is only available as a hosted service

FAQ

Q: How does APIRadar compare to GitHub’s own secret scanning? A: GitHub’s secret scanning runs per-repository when enabled by an administrator and notifies the repository owner directly. APIRadar operates at a platform level across all public repositories, providing a centralized searchable view and trend analysis. It is complementary to, not a replacement for, GitHub’s built-in scanning.

Q: Does APIRadar store the actual API keys? A: No. The platform stores only redacted key previews (prefix and suffix with the middle masked) and metadata. The actual secret is never stored or displayed.

Q: Can I monitor for keys from a specific organization? A: The public interface allows filtering by provider. For organization-specific monitoring, enterprise plans would need to be explored — the current public product does not have an explicit organizational dashboard feature documented.

Q: Is there an API to integrate APIRadar into a SIEM or ticketing system? A: The product page mentions an enterprise tier (“Enterprise Security Awareness” and “Private Monitoring — COMING SOON”). API documentation for programmatic access is not publicly linked, so integration details would need to be requested directly.

Q: How does this compare to tools like Gitleaks or TruffleHog? A: Gitleaks and TruffleHog are local/CLI tools that scan repositories you control or clone. APIRadar is a hosted, continuously updated platform that monitors the entire public GitHub surface. They serve different use cases — pre-commit scanning vs. real-time external exposure monitoring.

Conclusion

APIRadar fills a specific but critical gap in the developer security stack: real-time visibility into API key leaks across public GitHub. With automated key-harvesting bots active across the entire GitHub ecosystem, waiting for a leak to be reported is not an effective defense strategy.

For security teams, the platform provides immediate forensic data (provider, repository, timestamp) without requiring you to run your own scanning infrastructure across millions of public repos. For individual developers, the free tier offers a quick way to check whether your own keys have been exposed.

The main trade-off is the closed-source nature of the scanner — if you need a fully auditable, self-hosted solution, tools like Gitleaks paired with scheduled CI scans are a better fit. But for passive, real-time external exposure monitoring, APIRadar is purpose-built for the job.

→ Try it at apiradar.live