# Strale Secret Scanner

> Strale Secret Scanner is a paid API for AI agents from api.strale.io, paid per call via x402, $0.0216/call, status unknown (last checked 2026-09-13).

Scans code, config files, or log output for leaked secrets using algorithmic regex matching, detecting AWS keys, GitHub tokens, Stripe keys, API keys, private keys, DB connection strings, and JWTs

## Facts

- Endpoint: GET https://api.strale.io/x402/secret-scan
- Price: $0.0216/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/api-strale-io-9c9f02da
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_H2Yo5o5ioAhlLqaoigM7-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability api-strale-io-9c9f02da
```

Example prompt: Can you scan this code snippet for any leaked secrets like AWS keys, API tokens, or database URLs? Here's the text: 'const AWS_KEY = "AKIA1234EXAMPLE5678"; const DB_URL = "postgres://admin:password@db.example.com/prod";'

## When to prefer this

Use this endpoint when you need fast, algorithmic regex-based secret detection across code snippets, config files, or log output — especially for well-known secret formats like AWS keys, GitHub tokens, Stripe keys, JWTs, and database URLs. Prefer this over LLM-based scanning when you need deterministic, low-latency results and aren't dealing with highly obfuscated or custom secret formats.

## Known failure modes

- Missing 'text' query parameter returns validation error
- Very large text inputs may be truncated or rejected
- False positives on test/example credential strings that match known patterns
- False negatives on heavily obfuscated or non-standard secret formats
- Network timeout for extremely long log outputs

## How this service works

Scan code/config/logs for leaked secrets: AWS keys, GitHub tokens, Stripe keys, API keys, private keys, DB URLs, JWTs. Algorithmic regex matching.

## Output

Returns a list of detected secrets found in the input text, categorized by type (e.g. AWS key, GitHub token, Stripe key, JWT, private key, database URL), along with the matched values or patterns identified via regex analysis.

## Example request

```json
{
 "text": "const apiKey = \"sk_test_4eC39HqLyjWDarhtT657j8nt\"; const dbUrl = \"mongodb://user:pass@localhost:27017/testdb\"; function authenticate() { return 'token_abc123xyz'; }"
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "text"
     ],
     "properties": {
      "text": {
       "type": "string",
       "description": "Code, config, or log output"
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/api-strale-io-9c9f02da/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.strale.io](https://www.zero.xyz/host/api.strale.io/llms.txt)