Detection rules

21 secret detectors, and 3 public credential formats that KeyDrift recognises specifically so it never reports them as leaks. This page is generated from the rule catalog, so it cannot describe a detector that does not exist.

Secrets — must never reach a browser

criticalSupabase JWTsupabase-jwtFull read and write access to every table, bypassing Row Level Security.
criticalSupabase secret keysupabase-secret-keyFull read and write access to every table, bypassing Row Level Security.
criticalSupabase personal access tokensupabase-access-tokenManagement API access: can read, modify and delete every project on the account.
criticalStripe secret keystripe-secret-keyCharge cards, issue refunds, and read every customer record on the account.
highStripe restricted keystripe-restricted-keyScoped API access. What it reaches depends on the permissions granted at creation.
highWebhook signing secretstripe-webhook-secretLets an attacker forge webhook events your backend will accept as genuine.
criticalOpenAI API keyopenai-api-keyBillable API access. Scraper bots drain exposed keys within minutes of publication.
criticalOpenAI-compatible API keyopenai-legacy-keyBillable API access to whichever provider issued it.
criticalAnthropic API keyanthropic-api-keyBillable API access to the Claude API.
criticalAWS access key IDaws-access-key-idIdentifies an IAM principal. Paired with its secret, it grants that principal’s permissions.
criticalAWS secret access keyaws-secret-access-keyThe half of an AWS credential pair that actually authenticates. Grants the IAM principal’s permissions.
criticalGitHub tokengithub-tokenRepository access under the token’s scopes — for a classic PAT, usually every private repo the user can see.
criticalGitHub fine-grained tokengithub-fine-grained-tokenRepository access under the token’s explicitly granted permissions.
highResend API keyresend-api-keySend email from your verified domains — the raw material for a phishing campaign with your DKIM signature on it.
highSendGrid API keysendgrid-api-keySend email from your verified domains, and read suppression and contact lists.
highSlack tokenslack-tokenRead and post to whichever channels the token’s scopes cover.
highMapbox secret tokenmapbox-secret-tokenAccount-level Mapbox access, including creating and deleting tokens. Only `pk.` tokens belong in a browser.
criticalPostgres connection stringpostgres-connection-stringDirect database access with the embedded password — reads and writes every row, bypassing every application-level check.
criticalMongoDB connection stringmongodb-connection-stringDirect database access with the embedded password.
criticalPrivate keyprivate-key-pemAsymmetric private key material. For a Firebase or Google service account, this is full admin access to the project.
mediumCredential-shaped value in a client bundlegeneric-high-entropyAn unidentified credential was inlined into code the browser downloads. Anyone viewing the page can read it.

Secrets — must never reach a browser

Public — belongs in a browser, never reported as a leak