# GitHub/GitLab Secret Scanner

> GitHub/GitLab Secret Scanner is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.35/call, status unknown (last checked 2026-09-14).

Scans public GitHub/GitLab repositories associated with a domain to detect exposed API keys, tokens, and credentials committed in source code.

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/secret-scan
- Price: $0.35/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/github-gitlab-secret-scanner-997369c2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ehJKlL3R43Qud2WVEDhxx

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability github-gitlab-secret-scanner-997369c2 -d '<json body>'
```

Example prompt: Scan the public GitHub and GitLab repos associated with acme.com and tell me if any API keys, tokens, or hardcoded credentials have been committed to source code — I want to catch this before someone exploits it.

## When to prefer this

Choose this endpoint when you need to detect exposed secrets specifically in public source code repositories linked to a domain — particularly valuable for supply chain risk assessments, pre-integration vendor reviews, or pre-launch security audits. Prefer this over general breach or dark web checks when the specific concern is developer-committed credentials in GitHub or GitLab, not account-level data breaches or infostealer harvests.

## Known failure modes

- Domain has no associated public GitHub or GitLab repositories — returns empty results
- Domain association lookup fails if the domain is not linked to any public repo namespace
- Rate limiting or API throttling from GitHub/GitLab may limit scan depth
- Only public repositories are scanned — private repos will not be included
- False positives may occur with test/dummy credentials in code
- Request times out for domains with a very large number of associated repositories

## How this service works

Scan public GitHub/GitLab repositories associated with a domain for exposed API keys, tokens, and credentials committed in source code. Call to detect a common supply-chain exposure vector before it's exploited.

## Output

Returns a list of detected secrets found in public repositories associated with the domain, including secret type (API key, token, credential), the repository URL where they were found, commit references or file paths, and severity or risk indicators. The response helps identify specific exposed credentials that require immediate rotation or remediation.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Your own domain"
  },
  "vendor_domains": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "description": "Optional: vendor domains, up to 5"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/github-gitlab-secret-scanner-997369c2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)