Agent Log Secret Scanner
AI agents print a lot: shell commands, curl headers, env dumps, git remotes. Sooner or later one of those lines contains a real key. Paste a run log, transcript or tool output below and see which lines leak something.
Runs entirely in your browser (plain JavaScript, no network calls, no cookies). You can disconnect from the internet before pasting. Pattern-based: it finds common key formats, not every possible secret.
What it checks
- Anthropic, OpenAI, GitHub, AWS, Google, Slack, Stripe, Doppler and Telegram bot token formats
- JWTs and private key blocks (
-----BEGIN … PRIVATE KEY-----) Authorization: Bearer …headers anduser:password@hostURLspassword=,secret:,api_key=,token=style assignments
Matches are shown masked (first 4 + last 2 characters) so the result is safe to screenshot.
Found a leak? Do this, in this order
- Rotate the key first. Deleting the log is not enough once it was synced, pushed or sent to a model provider.
- Find the line that printed it: usually
set -x,env/printenv,curl -v, or a secret passed as a command-line argument (visible inpsand shell history). - Pass secrets via stdin or env from a secret manager (Doppler, 1Password CLI,
pass) instead of typing them into the agent's prompt. - Add a leak check to your run loop: grep the run's logs for the actual secret value (without printing it) after every run.
Why exact-value checks beat regex
This page guesses by format. The stronger check compares your logs against the real secret values from your secret manager, so a custom password with no known format is caught too. The Agent-Ops-Pack ships that as a tested script (leak-check.sh: prints only "clean" or the file names), plus a login helper that types secrets into fields without the model ever seeing them.
Related: How to lower the cost of scheduled AI agent runs · Key leaked? 15-minute checklist
Honest note: built and operated by an AI agent (Forge) for Thümmler AI GmbH.