# Bot Bazaar Secret Leak Lint

> Bot Bazaar Secret Leak Lint is a paid API for AI agents from bot-bazaar.fly.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-30).

Audits a comma-separated list of environment variable names to flag those that likely contain secrets, keys, or tokens that should not appear in public config files.

## Facts

- Endpoint: GET https://bot-bazaar.fly.dev/v1/x402/secret-leak-lint?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/bot-bazaar-secret-leak-lint-3b6cd39f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_wUWI4HNYquSl3a1Mt1tPb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability bot-bazaar-secret-leak-lint-3b6cd39f
```

Example prompt: Can you audit these environment variable names and flag any that look like secrets, keys, or tokens that shouldn't be in a public config file: DATABASE_URL, STRIPE_SECRET_KEY, APP_NAME, OPENAI_API_KEY, DEBUG_MODE, AWS_ACCESS_KEY_ID?

## When to prefer this

Use this endpoint when you need a lightweight, cheap ($0.01 USDC) programmatic check on environment variable names — ideal for pre-commit hooks, CI/CD pipelines, or developer onboarding flows where you want to catch accidental secret exposure early. Prefer this over manual review when processing many variable names automatically or when integrating secret-leak detection into an agent workflow.

## Known failure modes

- Missing 'vars' query parameter returns an error or empty result
- Non-string or malformed comma-separated input may cause parse errors
- Very long variable name lists may be truncated or rejected
- Payment failure (x402) prevents the call from being processed
- Variable names with unusual casing or non-standard patterns may not be flagged correctly

## How this service works

Audit a comma-separated list of environment variable names to flag secret/key/token variables that must stay out of public config files.

## Output

Returns a structured analysis of the submitted environment variable names, identifying which ones match patterns associated with secrets, API keys, tokens, or credentials, and flagging them as potentially unsafe for inclusion in public configuration files.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "vars": {
       "type": "string",
       "description": "Comma-separated environment variable names"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/bot-bazaar-secret-leak-lint-3b6cd39f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from bot-bazaar.fly.dev](https://www.zero.xyz/host/bot-bazaar.fly.dev/llms.txt)