Secret Graveyard - GitHub dorks for AI API keys, tokens, secrets & database connection strings. 60 providers + 8 database families.
☠ SECRET GRAVEYARD
GitHub dorks for AI API keys, access tokens & database connection strings
60 providers + 8 database families. Expanded GitHub search dorks.
· · · · ·
Search anatomy
This is a collection of GitHub dorks: advanced search queries that combine file paths, credential-field names, token patterns, and provider context to identify potential secret exposures in indexed code. Paste a dork into github.com/search and select Code, or use its direct search link.
File locations → credential names → signature or assignment → provider context.
The combined structure from the original reference is the foundation of this collection. Each entry has a fully expanded expression, followed by a shorter focused query. Both are for github.com/search with Code selected.
| Layer | Purpose | Example |
|---|---|---|
| FILES | Configurations, logs, backups, and key files | path:*.json OR path:*.env OR path:.env.* |
| FIELDS | Generic names plus provider-specific aliases | api_key OR access_token OR ANTHROPIC_API_KEY |
| SIGNAL | Token-family clue or literal-looking assignment | "sk-ant-" or an assignment regex |
| CONTEXT | Disambiguates shared token prefixes | anthropic OR claude |
Full expression: retains all 23 original extensions and all 13 original credential names, adds .env.*, and combines the provider signal in one expression. Focused search: shorter, broader, and below 256 characters; use it if GitHub rejects the full expression's length. Removing file filters also finds source-code occurrences.
No owner/repository placeholders are embedded. These are search heuristics, not credential validators. A matching example, placeholder, or unrelated value can still be a false positive. Review exposures only within your authorized scope.
Provider index
· · · · ·
· · · · · · · · · · · · · · · · · ·
· · · · · · · · · · ·
· · · · · · ·
· · · · · · ·
· · · · · ·
The original six
The six provider families from the source reference, kept together. Added clues include OpenAI project/service-account/admin families, fine-grained GitHub PATs, Slack app-level tokens, and Square’s EAAA family. Historical clues remain included.
01 · OpenAI
Token-family clues + provider context
sk-proj- · sk-svcacct- · sk-admin- · sk-
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("sk-proj-" OR "sk-svcacct-" OR "sk-admin-" OR "sk-") AND ("openai" OR "gpt")
Focused query
content:/sk-proj-|sk-svcacct-|sk-admin-|sk-/ ("openai" OR "gpt")
↗ Run focused search · Run full expression · Provider documentation
Project and administrative credentials have different privileges; do not assume a fixed key length.
02 · GitHub
Token-family clues + provider context
ghp_ · gho_ · ghu_ · ghs_ · ghr_ · github_pat_
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("ghp_" OR "gho_" OR "ghu_" OR "ghs_" OR "ghr_" OR "github_pat_") AND ("github" OR "oauth")
Focused query
content:/ghp_|gho_|ghu_|ghs_|ghr_|github_pat_/ ("github" OR "oauth")
↗ Run focused search · Run full expression · Provider documentation
Include classic, fine-grained, OAuth, App, and refresh-token families.
03 · Slack
Token-family clues + provider context
xox · xapp-
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("xox" OR "xapp-") AND ("slack")
Focused query
content:/xox|xapp-/ ("slack")
↗ Run focused search · Run full expression · Provider documentation
Bot, user, app-level, and other token types have different privileges.
04 · Google APIs
Token-family clues + provider context
AIza
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("AIza") AND ("google" OR "googleapis")
Focused query
content:/AIza/ ("google" OR "googleapis")
↗ Run focused search · Run full expression · Provider documentation
API restrictions and application restrictions matter; a match is not proof of compromise.
05 · Square
Token-family clues + provider context
sq0atp- · sq0csp- · EAAA
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("sq0atp-" OR "sq0csp-" OR "EAAA") AND ("square" OR "oauth")
Focused query
content:/sq0atp-|sq0csp-|EAAA/ ("square" OR "oauth")
↗ Run focused search · Run full expression · Provider documentation
Access tokens and application secrets should be reviewed separately.
06 · Shopify
Token-family clues + provider context
shpss_ · shpat_ · shpca_ · shppa_
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("shpss_" OR "shpat_" OR "shpca_" OR "shppa_") AND ("shopify")
Focused query
content:/shpss_|shpat_|shpca_|shppa_/ ("shopify")
↗ Run focused search · Run full expression · Provider documentation
Include app secrets and historical private/custom-app token families.
Foundation models & inference
07 · Anthropic
Token-family clues + provider context
sk-ant-api03- · sk-ant-admin01- · sk-ant-
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("sk-ant-api03-" OR "sk-ant-admin01-" OR "sk-ant-") AND ("anthropic" OR "claude")
Focused query
content:/sk-ant-api03-|sk-ant-admin01-|sk-ant-/ ("anthropic" OR "claude")
↗ Run focused search · Run full expression · Provider documentation
Claude API credentials are separate from consumer chat subscriptions.
08 · Google Gemini
Token-family clues + provider context
AIza
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("AIza") AND ("gemini" OR "generativelanguage")
Focused query
content:/AIza/ ("gemini" OR "generativelanguage")
↗ Run focused search · Run full expression · Provider documentation
A Google key prefix alone cannot identify the enabled API or its restrictions.
09 · xAI
Named credential assignment; no assumed provider prefix
XAI_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR XAI_API_KEY) AND content:/(?i)(XAI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(XAI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check inference credentials separately from management credentials.
10 · DeepSeek
Named credential assignment; no assumed provider prefix
DEEPSEEK_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR DEEPSEEK_API_KEY) AND content:/(?i)(DEEPSEEK_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(DEEPSEEK_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
OpenAI-compatible clients may store this credential under a generic variable name.
11 · Mistral AI
Named credential assignment; no assumed provider prefix
MISTRAL_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR MISTRAL_API_KEY) AND content:/(?i)(MISTRAL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(MISTRAL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Search both direct integrations and model-router configuration.
12 · Cohere
Named credential assignment; no assumed provider prefix
CO_API_KEY · COHERE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR CO_API_KEY OR COHERE_API_KEY) AND content:/(?i)(CO_API_KEY|COHERE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(CO_API_KEY|COHERE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Include embeddings and reranking integrations in the review.
13 · Groq
Named credential assignment; no assumed provider prefix
GROQ_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR GROQ_API_KEY) AND content:/(?i)(GROQ_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(GROQ_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Inference credentials may appear in OpenAI-compatible client configuration.
14 · Cerebras
Named credential assignment; no assumed provider prefix
CEREBRAS_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR CEREBRAS_API_KEY) AND content:/(?i)(CEREBRAS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(CEREBRAS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check low-latency inference examples and deployment configuration.
15 · SambaNova
Named credential assignment; no assumed provider prefix
SAMBANOVA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR SAMBANOVA_API_KEY) AND content:/(?i)(SAMBANOVA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(SAMBANOVA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Endpoint context helps distinguish generic API-key names.
16 · Together AI
Named credential assignment; no assumed provider prefix
TOGETHER_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR TOGETHER_API_KEY) AND content:/(?i)(TOGETHER_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(TOGETHER_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Review fine-tuning and inference jobs as well as application code.
17 · Fireworks AI
Named credential assignment; no assumed provider prefix
FIREWORKS_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR FIREWORKS_API_KEY) AND content:/(?i)(FIREWORKS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(FIREWORKS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check both hosted model calls and deployment scripts.
18 · OpenRouter
Named credential assignment; no assumed provider prefix
OPENROUTER_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR OPENROUTER_API_KEY) AND content:/(?i)(OPENROUTER_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(OPENROUTER_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
A routing credential can expose access to multiple upstream model families.
19 · Hugging Face
Token-family clues + provider context
hf_ · api_org_
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("hf_" OR "api_org_") AND ("huggingface" OR "HF_TOKEN")
Focused query
content:/hf_|api_org_/ ("huggingface" OR "HF_TOKEN")
↗ Run focused search · Run full expression · Provider documentation
Check token permissions: model downloads, inference, and repository writes differ.
20 · Replicate
Named credential assignment; no assumed provider prefix
REPLICATE_API_TOKEN
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR REPLICATE_API_TOKEN) AND content:/(?i)(REPLICATE_API_TOKEN)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(REPLICATE_API_TOKEN)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Inspect image and video workflows in addition to language-model code.
21 · Perplexity
Token-family clues + provider context
pplx-
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("pplx-") AND ("perplexity" OR "pplx")
Focused query
content:/pplx-/ ("perplexity" OR "pplx")
↗ Run focused search · Run full expression · Provider documentation
Search and answer-generation integrations may use different wrapper names.
22 · AI21
Named credential assignment; no assumed provider prefix
AI21_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR AI21_API_KEY) AND content:/(?i)(AI21_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(AI21_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check notebooks and application configuration for credentials.
23 · NVIDIA NIM
Named credential assignment; no assumed provider prefix
NVIDIA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR NVIDIA_API_KEY) AND content:/(?i)(NVIDIA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(NVIDIA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Hosted API credentials and self-hosted deployment credentials need separate review.
24 · DeepInfra
Named credential assignment; no assumed provider prefix
DEEPINFRA_API_TOKEN · DEEPINFRA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR DEEPINFRA_API_TOKEN OR DEEPINFRA_API_KEY) AND content:/(?i)(DEEPINFRA_API_TOKEN|DEEPINFRA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(DEEPINFRA_API_TOKEN|DEEPINFRA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
An OpenAI-compatible base URL may be the strongest provider clue.
25 · Novita AI
Named credential assignment; no assumed provider prefix
NOVITA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR NOVITA_API_KEY) AND content:/(?i)(NOVITA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(NOVITA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Search both model inference and media-generation integrations.
Image, video & voice
26 · fal
Named credential assignment; no assumed provider prefix
FAL_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR FAL_KEY) AND content:/(?i)(FAL_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(FAL_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check server code and workflow exports; media-generation credentials should stay server-side.
27 · Black Forest Labs
Named credential assignment; no assumed provider prefix
BFL_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR BFL_API_KEY) AND content:/(?i)(BFL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(BFL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
FLUX integrations may use an x-key header instead of a Bearer header.
28 · Stability AI
Named credential assignment; no assumed provider prefix
STABILITY_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR STABILITY_API_KEY) AND content:/(?i)(STABILITY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(STABILITY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Look at creative tools, notebooks, and exported workflow configurations.
29 · Runway
Named credential assignment; no assumed provider prefix
RUNWAYML_API_SECRET · RUNWAY_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR RUNWAYML_API_SECRET OR RUNWAY_API_KEY) AND content:/(?i)(RUNWAYML_API_SECRET|RUNWAY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(RUNWAYML_API_SECRET|RUNWAY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Include background rendering workers and job queues in the audit.
30 · Luma AI
Named credential assignment; no assumed provider prefix
LUMAAI_API_KEY · LUMA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR LUMAAI_API_KEY OR LUMA_API_KEY) AND content:/(?i)(LUMAAI_API_KEY|LUMA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(LUMAAI_API_KEY|LUMA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Dream Machine integrations may store credentials in backend worker configuration.
31 · ElevenLabs
Named credential assignment; no assumed provider prefix
ELEVENLABS_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR ELEVENLABS_API_KEY) AND content:/(?i)(ELEVENLABS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(ELEVENLABS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
The xi-api-key header is useful context when environment names are absent.
32 · Cartesia
Named credential assignment; no assumed provider prefix
CARTESIA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR CARTESIA_API_KEY) AND content:/(?i)(CARTESIA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(CARTESIA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Review realtime voice integrations and WebSocket setup code.
33 · Deepgram
Named credential assignment; no assumed provider prefix
DEEPGRAM_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR DEEPGRAM_API_KEY) AND content:/(?i)(DEEPGRAM_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(DEEPGRAM_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Streaming and prerecorded audio integrations can share credentials.
34 · AssemblyAI
Named credential assignment; no assumed provider prefix
ASSEMBLYAI_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR ASSEMBLYAI_API_KEY) AND content:/(?i)(ASSEMBLYAI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(ASSEMBLYAI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Inspect transcription workers and upload-processing configuration.
35 · Speechmatics
Named credential assignment; no assumed provider prefix
SPEECHMATICS_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR SPEECHMATICS_API_KEY) AND content:/(?i)(SPEECHMATICS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(SPEECHMATICS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Endpoint matching is broad; combine it with authentication terms.
36 · Resemble AI
Named credential assignment; no assumed provider prefix
RESEMBLE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR RESEMBLE_API_KEY) AND content:/(?i)(RESEMBLE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(RESEMBLE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Review speech-generation and voice-management integrations.
37 · Hume AI
Named credential assignment; no assumed provider prefix
HUME_API_KEY · HUME_SECRET_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR HUME_API_KEY OR HUME_SECRET_KEY) AND content:/(?i)(HUME_API_KEY|HUME_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(HUME_API_KEY|HUME_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
API keys and secret keys are distinct credentials; inspect both.
Search, browsing & agents
38 · Tavily
Named credential assignment; no assumed provider prefix
TAVILY_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR TAVILY_API_KEY) AND content:/(?i)(TAVILY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(TAVILY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Agent web-search tools often introduce this credential through environment files.
39 · Exa
Named credential assignment; no assumed provider prefix
EXA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR EXA_API_KEY) AND content:/(?i)(EXA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(EXA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Review search, content retrieval, and research-agent integrations.
40 · Firecrawl
Named credential assignment; no assumed provider prefix
FIRECRAWL_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR FIRECRAWL_API_KEY) AND content:/(?i)(FIRECRAWL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(FIRECRAWL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check ingestion jobs and crawler configuration.
41 · Brave Search
Named credential assignment; no assumed provider prefix
BRAVE_API_KEY · BRAVE_SEARCH_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR BRAVE_API_KEY OR BRAVE_SEARCH_API_KEY) AND content:/(?i)(BRAVE_API_KEY|BRAVE_SEARCH_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(BRAVE_API_KEY|BRAVE_SEARCH_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
The X-Subscription-Token header is another useful clue.
42 · SerpApi
Named credential assignment; no assumed provider prefix
SERPAPI_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR SERPAPI_API_KEY) AND content:/(?i)(SERPAPI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(SERPAPI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Credentials in URL query parameters can also surface in logs.
43 · Browserbase
Named credential assignment; no assumed provider prefix
BROWSERBASE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR BROWSERBASE_API_KEY) AND content:/(?i)(BROWSERBASE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(BROWSERBASE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Project IDs are identifiers; distinguish them from API keys.
44 · E2B
Named credential assignment; no assumed provider prefix
E2B_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR E2B_API_KEY) AND content:/(?i)(E2B_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(E2B_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Audit sandbox-launch code and agent deployment configuration.
45 · Composio
Named credential assignment; no assumed provider prefix
COMPOSIO_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR COMPOSIO_API_KEY) AND content:/(?i)(COMPOSIO_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(COMPOSIO_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Review connected-account authorization as well as the platform API key.
Retrieval, data & observability
46 · Pinecone
Named credential assignment; no assumed provider prefix
PINECONE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR PINECONE_API_KEY) AND content:/(?i)(PINECONE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(PINECONE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Vector data can contain private application content; review key permissions.
47 · Qdrant
Named credential assignment; no assumed provider prefix
QDRANT_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR QDRANT_API_KEY) AND content:/(?i)(QDRANT_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(QDRANT_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Cloud cluster URLs and API keys are different fields.
48 · Weaviate
Named credential assignment; no assumed provider prefix
WEAVIATE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR WEAVIATE_API_KEY) AND content:/(?i)(WEAVIATE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(WEAVIATE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check both database access and upstream model-provider credentials.
49 · Voyage AI
Named credential assignment; no assumed provider prefix
VOYAGE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR VOYAGE_API_KEY) AND content:/(?i)(VOYAGE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(VOYAGE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Embedding and reranking jobs frequently run outside the main application.
50 · Jina AI
Named credential assignment; no assumed provider prefix
JINA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR JINA_API_KEY) AND content:/(?i)(JINA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(JINA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Inspect document ingestion, search, and embedding services.
51 · LangSmith
Named credential assignment; no assumed provider prefix
LANGSMITH_API_KEY · LANGCHAIN_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR LANGSMITH_API_KEY OR LANGCHAIN_API_KEY) AND content:/(?i)(LANGSMITH_API_KEY|LANGCHAIN_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(LANGSMITH_API_KEY|LANGCHAIN_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Old and new configuration names may coexist in application repositories.
52 · Langfuse
Named credential assignment; no assumed provider prefix
LANGFUSE_SECRET_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR LANGFUSE_SECRET_KEY) AND content:/(?i)(LANGFUSE_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(LANGFUSE_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Distinguish the secret key from the companion public key.
53 · Weights & Biases
Named credential assignment; no assumed provider prefix
WANDB_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR WANDB_API_KEY) AND content:/(?i)(WANDB_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(WANDB_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Training and experiment-tracking credentials may live in notebooks or CI files.
Cloud & application infrastructure
54 · AWS / Bedrock
Named credential assignment; no assumed provider prefix
AWS_ACCESS_KEY_ID · AWS_SECRET_ACCESS_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR AWS_ACCESS_KEY_ID OR AWS_SECRET_ACCESS_KEY) AND content:/(?i)(AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
An access-key ID alone is not a complete credential; also review session tokens and IAM roles.
55 · Azure OpenAI
Named credential assignment; no assumed provider prefix
AZURE_OPENAI_API_KEY · AZURE_OPENAI_ENDPOINT
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR AZURE_OPENAI_API_KEY OR AZURE_OPENAI_ENDPOINT) AND content:/(?i)(AZURE_OPENAI_API_KEY|AZURE_OPENAI_ENDPOINT)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(AZURE_OPENAI_API_KEY|AZURE_OPENAI_ENDPOINT)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
An endpoint is not a secret. Entra ID authentication uses a different credential flow.
56 · Google Cloud / Vertex AI
Named credential assignment; no assumed provider prefix
GOOGLE_APPLICATION_CREDENTIALS · private_key_id
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR GOOGLE_APPLICATION_CREDENTIALS OR private_key_id) AND content:/(?i)(GOOGLE_APPLICATION_CREDENTIALS|private_key_id)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(GOOGLE_APPLICATION_CREDENTIALS|private_key_id)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
A credential file path is not a key. Review service-account JSON and workload identity separately.
57 · Cloudflare Workers AI
Named credential assignment; no assumed provider prefix
CLOUDFLARE_API_TOKEN
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR CLOUDFLARE_API_TOKEN) AND content:/(?i)(CLOUDFLARE_API_TOKEN)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(CLOUDFLARE_API_TOKEN)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check account permissions and token scope; account IDs are not secret credentials.
58 · Vercel AI Gateway
Named credential assignment; no assumed provider prefix
AI_GATEWAY_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR AI_GATEWAY_API_KEY) AND content:/(?i)(AI_GATEWAY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(AI_GATEWAY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Gateway API keys and deployment identity authentication have different lifecycles.
59 · Supabase
Named credential assignment; no assumed provider prefix
SUPABASE_SERVICE_ROLE_KEY · SUPABASE_SECRET_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR SUPABASE_SERVICE_ROLE_KEY OR SUPABASE_SECRET_KEY) AND content:/(?i)(SUPABASE_SERVICE_ROLE_KEY|SUPABASE_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(SUPABASE_SERVICE_ROLE_KEY|SUPABASE_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Publishable and legacy anon keys are designed for client use; elevated secret keys are not.
60 · Stripe
Named credential assignment; no assumed provider prefix
STRIPE_SECRET_KEY · STRIPE_WEBHOOK_SECRET
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR STRIPE_SECRET_KEY OR STRIPE_WEBHOOK_SECRET) AND content:/(?i)(STRIPE_SECRET_KEY|STRIPE_WEBHOOK_SECRET)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(STRIPE_SECRET_KEY|STRIPE_WEBHOOK_SECRET)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Secret API keys and webhook signing secrets have different purposes; publishable keys are not secrets.
Database connection strings
08 database families · credential-bearing URLs, DSNs, and paired authentication settings
Connection strings can combine a host, database, username, and password. They can also be harmless routing information with authentication supplied elsewhere. No query here proves full access. Privileges depend on the database account's grants, roles, network controls, and other authentication requirements.
Full expressions combine file filters, connection syntax, and authentication/configuration context. Focused queries broaden coverage to source files and alternate variable names. All examples below are fully redacted format illustrations—not captured credentials or verified findings.
DB-01 · PostgreSQL
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"postgres://" OR content:"postgresql://" OR content:"jdbc:postgresql:") AND (DATABASE_URL OR POSTGRES_URL OR PGDATABASE OR password OR username)
Focused query
(content:"postgres://" OR content:"postgresql://" OR content:"jdbc:postgresql:")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: postgresql://[USER]:[REDACTED]@[HOST]:5432/[DATABASE]
Also inspect libpq keyword strings: host, dbname, user, and password may appear separately. A postgres username is only a privilege clue; inspect role attributes, grants, and row-level security.
DB-02 · MySQL / MariaDB
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"mysql://" OR content:"mariadb://" OR content:"jdbc:mysql:" OR content:"jdbc:mariadb:") AND (DATABASE_URL OR MYSQL_URL OR MARIADB_URL OR password OR username)
Focused query
(content:"mysql://" OR content:"mariadb://" OR content:"jdbc:mysql:" OR content:"jdbc:mariadb:")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: mysql://[USER]:[REDACTED]@[HOST]:3306/[DATABASE]
A root account name warrants review but is not proof of reachable access. Check host restrictions, grants, and whether the password is stored separately.
DB-03 · MongoDB
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"mongodb://" OR content:"mongodb+srv://") AND (MONGODB_URI OR MONGO_URI OR DATABASE_URL OR authSource OR password)
Focused query
(content:"mongodb://" OR content:"mongodb+srv://")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: mongodb+srv://[USER]:[REDACTED]@[HOST]/[DATABASE]
authSource=admin identifies the authentication database, not an administrative role. Review assigned roles and network restrictions.
DB-04 · Redis / Valkey
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"redis://" OR content:"rediss://") AND (REDIS_URL OR REDIS_URI OR CACHE_URL OR password OR username)
Focused query
(content:"redis://" OR content:"rediss://")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: rediss://[USER]:[REDACTED]@[HOST]:6379/0
Check ACL permissions, TLS, and network exposure. Some clients use a password-only URL or separate username/password fields; a database number is not a permission boundary.
DB-05 · Microsoft SQL Server
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"jdbc:sqlserver:" OR content:"mssql://" OR content:"sqlserver://" OR content:"Initial Catalog") AND (content:"Password" OR content:"PWD" OR content:"User ID" OR content:"UID")
Focused query
(content:"jdbc:sqlserver:" OR content:"mssql://" OR content:"sqlserver://" OR content:"Initial Catalog")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: Server=[HOST];Database=[DATABASE];User ID=[USER];Password=[REDACTED]
Include ODBC and ADO.NET property strings. Integrated Security or Trusted_Connection can use the process identity instead of a password; sa is a review clue, not proof of authentication or sysadmin access.
DB-06 · Oracle Database
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"jdbc:oracle:" OR content:"oracle://" OR content:"oracle+oracledb://" OR content:"DESCRIPTION=") AND (DATABASE_URL OR ORACLE_DSN OR password OR content:"User Id")
Focused query
(content:"jdbc:oracle:" OR content:"oracle://" OR content:"oracle+oracledb://" OR content:"DESCRIPTION=")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: oracle+oracledb://[USER]:[REDACTED]@[HOST]:1521/?service_name=[SERVICE]
A TNS descriptor usually identifies a destination rather than carrying authentication. Credentials may be separate or held in a wallet; SYSDBA requires explicit authorization and cannot be inferred from a DSN.
DB-07 · ClickHouse
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"clickhouse://" OR content:"clickhouses://" OR content:"jdbc:clickhouse:") AND (CLICKHOUSE_URL OR DATABASE_URL OR password OR username)
Focused query
(content:"clickhouse://" OR content:"clickhouses://" OR content:"jdbc:clickhouse:")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: clickhouse://[USER]:[REDACTED]@[HOST]:9000/[DATABASE]
Schemes and ports depend on the driver. Also inspect HTTP client settings with separate user/password fields. A default username does not establish broad grants.
DB-08 · Neo4j
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"neo4j://" OR content:"neo4j+s://" OR content:"bolt://" OR content:"bolt+s://") AND (NEO4J_AUTH OR NEO4J_PASSWORD OR password OR basic_auth)
Focused query
(content:"neo4j://" OR content:"neo4j+s://" OR content:"bolt://" OR content:"bolt+s://")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: NEO4J_URI=neo4j+s://[HOST]:7687; NEO4J_AUTH=[USER]/[REDACTED]
Neo4j drivers commonly keep authentication separate from the connection URI. Inspect the paired auth configuration and database roles; finding a Bolt URI alone is not a credential exposure.
Privileged-access review
| Finding | What it establishes | What still needs review |
|---|---|---|
| Username and password embedded in a URL | Potential credential material in a configuration value | Whether it is a placeholder, active, reachable, and authorized for the target database |
root, postgres, sa, or SYS username | A potentially sensitive account name | Actual roles, grants, host restrictions, and authentication mode |
authSource=admin | MongoDB authentication database selection | The authenticated user's assigned roles |
sslmode=require, rediss://, or a TLS-enabled scheme | A transport configuration clue | Certificate verification, authentication, and privileges |
| URI plus a separate password or auth field | Potentially related connection settings in the same file | Whether the fields actually belong together |
For an authorized report, redact the complete credential value and any sensitive host/database identifiers before publishing. Rotate exposed credentials through the database or managed-service controls; changing a connection-string variable alone does not revoke the underlying account.
Precision & coverage
Token-family searches
Distinctive prefixes are useful clues, but do not establish whether a credential is real, active, or associated with the provider named elsewhere in a file. The original OpenAI fixed-length sk- pattern only describes a historical shape; it is not a universal modern-key rule.
Historical OpenAI shape — not a modern-key validator:
content:/sk-[A-Za-z0-9]{48}/ (openai OR gpt)
Prefix clues are informed by the original reference and Gitleaks' published detection rules. They intentionally omit claims of complete token validation. The source reference's OpenAI regex contribution credited fkulakov.
Assignment searches
For providers without a confirmed distinctive prefix in this guide, the query looks for a credential field followed by : or = and at least 16 token-like characters. That threshold is a noise-reduction heuristic, not an official key length.
These expressions cover common .env, JSON, YAML, and source-code assignments. They can miss short values, multiline values, punctuation outside the chosen character set, alternate variable names, custom proxies, and credentials passed directly to a client constructor. Unquoted references such as process.env.SOME_LONG_VARIABLE can still match. Check the source context.
File filters
The full expressions focus on configuration and auxiliary files, as the original reference does. This excludes many .py, .js, .ts, .ipynb, and extensionless files. Use the focused query to include those locations, or add the extensions relevant to your application. A .enc filename does not make encrypted content searchable.
Additional search locations
These recipes locate potentially relevant files and authentication references. They do not assert that a matching file contains a literal secret.
| Surface | Copy into GitHub Code Search |
|---|---|
| MCP configuration | (path:mcp.json OR path:claude_desktop_config.json) (api_key OR token OR secret) |
| Notebooks | path:*.ipynb (api_key OR access_token OR Authorization) |
| CI workflows | path:.github/workflows (api_key OR token OR secret) |
| Container configuration | (path:Dockerfile OR path:docker-compose OR path:compose.yaml) (api_key OR token OR secret) |
| Environment variants | `path:/(^ |
| Saved logs | (path:*.log OR path:*.txt) (Authorization OR api_key OR access_token) |
| Backups | (path:*.bak OR path:*.backup OR path:*.tmp) (api_key OR token OR secret) |
| Browser-exposed names | (NEXT_PUBLIC_ OR VITE_ OR PUBLIC_) (SECRET OR API_KEY) |
Reading a result
Illustrative classification examples — not harvested credentials or live findings. Values below are placeholders; no validity checks were performed.
| Snippet | Classification | Why |
|---|---|---|
ANTHROPIC_API_KEY="[REDACTED]" | Needs context | A literal assignment is worth reviewing, but masking alone proves nothing about the original value. |
os.environ["ANTHROPIC_API_KEY"] | Reference only | Reads a value from the environment. The value is not present here. |
api_key="your-api-key" | Example placeholder | Documentation template, not evidence of an exposed credential. |
${{ secrets.OPENAI_API_KEY }} | Secret-store reference | Refers to a CI secret without revealing its stored value. |
SUPABASE_SERVICE_ROLE_KEY="[REDACTED]" | Review permissions | Elevated server-side access differs from a client-facing publishable key. |
For an authorized report, mask the entire value, including any appearance in a URL, screenshot, log, or surrounding line. Record the provider, file location, classification, and remediation status. Do not label a match “live” unless an authorized assessment establishes that fact.
Original parameter coverage
File extensions — all 23 retained
| Group | Extensions |
|---|---|
| Structured data | .xml · .json · .properties · .sql |
| Text, logs, temporary files | .txt · .log · .tmp |
| Backups and encrypted-file names | .backup · .bak · .enc |
| Configuration | .yml · .yaml · .toml · .ini · .config · .conf · .cfg |
| Environments and credential files | .env · .envrc · .prod · .secret · .private · .key |
| Added coverage | .env.*, such as .env.local and .env.production |
Credential field names — all 13 retained
| Family | Names |
|---|---|
| Access | access_key · secret_key · access_token |
| API | api_key · apikey · api_secret · apiSecret |
| Application | app_secret · application_key · app_key · appkey |
| Authentication | auth_token · authsecret |
Search limitations
GitHub combines terms at the file level; two terms can occur on unrelated lines. A compound query is not proof that a key, provider label, and endpoint belong to the same integration. Search coverage is limited by indexing and does not replace a Git-history audit. Empty results do not establish that a repository is clean.
Browser Code Search supports Boolean operators, content qualifiers, and slash-delimited regex. The CLI and REST API may behave differently. See GitHub's syntax reference and search coverage.
Response to an authorized finding
Revoke or rotate → update dependents → review usage → remove exposure → prevent recurrence.
Deleting a committed value does not revoke it. Use the provider's controls to rotate it, review permissions and usage, then handle current files and history as appropriate. Report a third party's accidental exposure privately without publishing or testing the credential.
Credits & further reading
Created by AKCodez. Based on the search structure and factual provider/parameter coverage in win3zz's original reference, with expanded AI-provider coverage and independently written explanations. No original screenshot or exposed credential is reproduced. This is a standalone gist.
Original resource links: Online IDE Search · Keyhacks · Google Hacking Database.
Detection references: Gitleaks · TruffleHog · GitHub supported secret patterns.
SECRET GRAVEYARD
60 providers & platforms + 8 database families · GitHub dork collection · Updated October 18, 2026
点赞
收藏
点踩
分享