Exposed key
GitHub key exposed: what to do
The token can read or write whatever it was granted. A public /.git/config that contains one is enough for someone to copy it.
How to recognize it
Fine-grained and classic GitHub tokens match known prefixes in the public files we fetch. A git remote URL that embeds a token is the same class of problem.
What to do
Revoke the token on GitHub, remove it from the bundle and from any remote URL, and stop serving the .git directory.
Paste the public URL of an app you own. The scan reads the page, up to 10 same-origin scripts, and /.env, /.env.local, and /.env.production. It does not search the whole internet, and it does not submit the key to GitHub to see if it still works.
What does an exposed GitHub key look like?
Fine-grained and classic GitHub tokens match known prefixes in the public files we fetch. A git remote URL that embeds a token is the same class of problem.
Do you store the key if the scan finds one?
No. The report stores a masked fragment and the kind of key. The full value is not written to the database, and the fix prompt does not repeat it.
What should I do with a leaked GitHub key?
Revoke the token on GitHub, remove it from the bundle and from any remote URL, and stop serving the .git directory.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.