LeakGoblin
An open-source command-line tool for scanning and redacting sensitive information that detects and masks API keys, credentials and other sensitive data before text is pasted into AI tools.
Timeline (last 90 days)
LeakGoblin is an open-source command-line tool for scanning and redacting sensitive information before text leaves the local machine.
LeakGoblin offers two main functions, scanning and redaction, and supports a repository scan mode.
LeakGoblin requires a Node 20+ runtime and can be tried directly via npx or installed globally.
When scanning, LeakGoblin outputs masked fragments of the keys it finds and never prints a complete key.
LeakGoblin's redaction function replaces sensitive information with placeholders like [REDACTED:API_KEY:aws_access_key], preserving the surrounding text context.
LeakGoblin defines exit codes: 0 means no findings, 1 means keys were found, and 2 means an error occurred, making CI integration easier.
LeakGoblin's core detection mechanism is a set of format-specific regular expression signatures covering private key blocks, AWS credentials, GitHub/Stripe/Slack/Google/OpenAI-style API keys, Bearer tokens, JWTs, password assignments, connection strings, and more.
Strings starting with AKIA and matching the length and character set are flagged by LeakGoblin as high confidence; generic patterns such as password = ... are flagged as medium confidence; heuristic results for long random strings are flagged as low confidence and low severity.
LeakGoblin runs entirely locally, with no network requests, no telemetry, no uploads, and no accounts.
LeakGoblin is released under the MIT license and is free to use.
3 more timeline events
All Facts (13)
LeakGoblin does not aim to replace gitleaks or trufflehog; the latter target git history and organization-wide repository scanning, whereas LeakGoblin targets the narrower moment from clipboard to AI chat window or issue tracker.
50%UnverifiedLeakGoblin offers two main functions, scanning and redaction, and supports a repository scan mode.
50%UnverifiedLeakGoblin requires a Node 20+ runtime and can be tried directly via npx or installed globally.
50%UnverifiedWhen scanning, LeakGoblin outputs masked fragments of the keys it finds and never prints a complete key.
50%UnverifiedLeakGoblin's redaction function replaces sensitive information with placeholders like [REDACTED:API_KEY:aws_access_key], preserving the surrounding text context.
50%UnverifiedLeakGoblin defines exit codes: 0 means no findings, 1 means keys were found, and 2 means an error occurred, making CI integration easier.
50%UnverifiedLeakGoblin's core detection mechanism is a set of format-specific regular expression signatures covering private key blocks, AWS credentials, GitHub/Stripe/Slack/Google/OpenAI-style API keys, Bearer tokens, JWTs, password assignments, connection strings, and more.
50%UnverifiedStrings starting with AKIA and matching the length and character set are flagged by LeakGoblin as high confidence; generic patterns such as password = ... are flagged as medium confidence; heuristic results for long random strings are flagged as low confidence and low severity.
50%UnverifiedLeakGoblin runs entirely locally, with no network requests, no telemetry, no uploads, and no accounts.
50%UnverifiedLeakGoblin is released under the MIT license and is free to use.
50%UnverifiedLeakGoblin is an open-source command-line tool for scanning and redacting sensitive information before text leaves the local machine.
50%UnverifiedLeakGoblin is a best-effort filter, not a guarantee; it cannot replace a secrets manager or vault, does not protect against a compromised operating system, and is not a compliance certification.
50%UnverifiedLeakGoblin's planned roadmap includes: more provider token signatures (Azure, GCP, npm, etc.), SARIF output, --fix to write back redacted files, pre-commit hook examples, a VS Code extension, and better .env and Docker secret detection.
50%