Continuous secret monitoring for deployed apps

A scan is a photograph. Monitoring is the film.

The distinction decides whether this product helps you. A single scan answers "is anything exposed right now?" — worth having, and free here for exactly that reason. But deployments keep happening. Agents keep imitating the patterns already in your repo. Preview builds get promoted, templates carry their defaults into fresh projects, and the fix that held in March quietly fails in May when someone re-adds the call that made a query work. The most expensive finding is not the first one; it is the reintroduction nobody noticed because everyone believed the earlier clean report still applied.

So KeyDrift treats consecutive scans as a series, not as isolated verdicts. Each scheduled run fetches the deployment again and diffs its findings against history. Three transitions can emerge, and only these three alert anyone:

• Created — a credential appeared that was not there before.
• Regressed — a finding you resolved has come back. The alert says so explicitly, because a regression is a different event with a different meaning: something about how the codebase produces bundles did not hold.
• Resolved — the key is gone from a complete scan, and only a complete scan can say it; a partial fetch never resolves anything, because "absent" and "not looked at" are indistinguishable and resolving on that would tell you your key is safe because the scanner had a bad minute.

Everything else stays silent. Public credentials appearing in new chunks are build details, not events. Replays and retries emit nothing twice — alerts dedupe on destination, fingerprint, kind and timestamp, so one transition delivers once no matter how many times a scan is replayed or a job retried.

What plans change is coverage, never truth. Free watches one project daily. Indie watches three hourly and adds Slack. Team watches fifteen every fifteen minutes and adds Discord plus raw webhooks with per-destination severity thresholds. No plan withholds findings behind an upgrade prompt — a security tool that ransoms its own results is not a security tool, and there is no field in our entitlements model that could express it even by accident.

The interfaces on this hub exist because teams already have places where news finds them. Alerts route into Slack channels and Discord servers with payloads flat enough to parse in one glance: what leaked, how severe, masked value, fingerprint, chunk filename, scanned URL, timestamp. Raw webhooks carry the same payload anywhere else, SSRF-checked when you save the destination and checked again at send time, because a hostname that resolved publicly last week can point somewhere private today. The HTTP API exposes the same engine without the UI. The CLI runs it locally with exit codes that mean what they say — zero clean, one findings, two could-not-scan — because a pipeline that conflates "the scanner broke" with "the app leaks" gets switched off within a week.