Seven x2y tools remain free. Code Leak Detector is $29 as a one-time purchase.
View productsScan & Detect Exposed Secrets in Code
Desktop application that scans your entire codebase for accidentally exposed secrets — API keys, tokens, passwords, and other sensitive data. 200+ detection patterns with 100% offline processing.
One-time purchase. No subscriptions, no recurring fees, no account required. Copies obtained during the free period continue to work indefinitely.
At a glance
Copies obtained during the free period keep working. No account, no activation ping, no subscription.
Key features
AWS access keys, GitHub tokens, Slack webhooks, Stripe secret keys, Google API credentials, private RSA/EC keys, JWT secrets, database connection strings, npm tokens, PyPI credentials and hundreds more — all matched locally against an offline rule pack.
Every scan runs entirely on your hardware. Source code, detected secrets, scan reports and rule packs never touch the network. There is no cloud analysis tier, no "send for deeper inspection" option, no telemetry pipeline. Verify with any network monitor.
Point the watcher at a working directory and receive instant notifications the moment a new secret is written to disk. Catch the leak at the keystroke — before it is staged, committed, or pushed to any remote.
Beyond pattern matching, the entropy analyser flags high-randomness strings that look like secrets even when they do not match a known pattern. Catch obfuscated keys, rotated tokens and novel credential formats that rule-based scanners miss.
Advanced capabilities
Run Gitleaks and TruffleHog rule sets alongside the native engine from a single interface. Combine detection strategies without leaving the application or managing separate toolchains. Results are merged, deduplicated and presented in a unified report.
Secrets hide in compiled binaries, compressed archives and embedded resources. Deep scan mode unpacks ZIP, 7Z, TAR, GZ and JAR files in memory, inspects binary strings and extracts credentials that surface-level scanners never reach.
Mark a finding as a false positive and the learning engine suppresses identical patterns in future scans — per project, per file, or globally. The allowlist is stored locally and never shared. Tune the scanner to your codebase without losing coverage.
Detected secrets are held in protected memory regions and masked in every output — the UI, the report, the clipboard. Full values are never written to log files, temporary directories or swap. When the scan ends, the memory is zeroed.
Specifications
| Product | Code Leak Detector |
|---|---|
| Version | v2.0.5 |
| Platform | Windows 10, Windows 11 |
| Detection patterns | 200+ (offline rule pack) |
| Detection methods | Pattern matching + entropy analysis |
| Integrations | Gitleaks, TruffleHog rule sets |
| Deep scan | Binaries, ZIP, 7Z, TAR, GZ, JAR |
| Real-time watch | File system watcher with instant alerts |
| Learning mode | Per-project, per-file, global allowlists |
| Reports | JSON, SARIF, CSV — CI-compatible |
| Pre-commit | Supported via CLI hook |
| Memory safety | Protected regions, zeroed on exit |
| Processing | 100% local — no cloud relay |
| Telemetry | 0 bytes — verified continuously |
| Account required | None — ever |
| Price | $29 one-time |
| Developer | x2y Devs Tools Ltd, Nairobi, Kenya |
Quick start
Download from itch.io. Run the installer — no administrator privileges required for standard installs. No account creation or subscription. Purchase once for $29.
Select a working tree, a specific path, or an entire drive. Choose standard or deep scan mode. Enable Gitleaks or TruffleHog rule sets if desired. The rule pack loads from disk — no network fetch.
Findings appear in the dashboard with masked values, severity tags, file paths and line numbers. Use intelligent filtering to triage by risk level. Mark false positives to train the learning engine.
Export the report as JSON, SARIF or CSV for your CI pipeline. Rotate exposed credentials immediately. Use the pre-commit hook to prevent future leaks from reaching version history.
Downloads
Changelog
Expanded rule pack to 200+ detection patterns. Entropy-based secret detection for custom and obfuscated patterns. Gitleaks and TruffleHog rule set integration. Deep scan mode for binaries and compressed archives (ZIP, 7Z, TAR, GZ, JAR). Learning mode with per-project, per-file and global allowlists. Real-time file watcher with instant alerts. Secure memory handling with zeroed buffers on exit. SARIF and JSON report export for CI pipelines. Pre-commit hook support.
Report engine rewrite. Intelligent filtering by severity, file type and pattern category. Scan history with trend analysis across multiple runs. Masked value display in all outputs. CSV export added alongside JSON.
Initial release. Core pattern-matching engine with 80+ rules. Basic scan and report workflow. Manual scan only — no file watcher.
Security model
Code Leak Detector reads the files you tell it to scan — that is its function. It does not transmit source code, detected secrets, scan reports, file paths, or any other data anywhere. The rule pack is embedded in the installer and exists entirely on your filesystem. Detected secrets are masked in every output surface — the dashboard, the report, the clipboard — and held in protected memory regions that are zeroed when the scan completes. There is no cloud analysis tier, no "send for deeper inspection" option, no analytics SDK, no crash reporter. Verify with Wireshark, Fiddler, GlassWire or your firewall logs — you will observe zero outbound connections.
| Telemetry | 0 bytes collected |
|---|---|
| Account | None required — ever |
| Source access | Only directories you explicitly select |
| Detected secrets | Masked in all outputs, zeroed on exit |
| Rule packs | Bundled locally, never fetched |
| Cloud analysis | None — all scans local |
| Network | Zero outbound connections |
| Verification | Any network monitor |
Detection model
Most real leaks are boring: a provider key in the shape the provider documents. The offline rule pack ships 200+ patterns covering access tokens, refresh tokens, API keys, private key blocks, database URLs and service-account files, matched against file contents as the scan walks your tree.
Because the rules are local and versioned, a finding is reproducible. The same repository, the same rule pack and the same exclusions produce the same report — which is exactly what you need if a scan is part of a release checklist or an audit.
Custom headers, in-house token formats and obfuscated constants do not match a known shape. For those, the scanner scores character entropy and structure — long, high-entropy strings assigned to variables named like credentials — and reports them separately as candidates rather than confirmations.
That split matters operationally. Confirmed pattern hits should be treated as leaked. Entropy candidates are a review queue, and the tool is honest enough to label them that way.
The scanner ingests Gitleaks and TruffleHog rule sets, so an organisation that standardised on either can align findings without changing tools. Nothing is delegated to those projects: matching runs in-process against the bundled packs.
Learning mode lets you suppress a finding per file, per project or globally, with the reason recorded. That is the difference between a scanner a team keeps using and one they disable after a week of test fixtures tripping on every commit.
Secure memory handling closes the other half of the loop: matched values are masked in the interface and reports, protected regions are zeroed on exit, and candidate secrets are never written to a plaintext temporary file on the way to a report.
How it works
Choose a working directory, a folder of exports or a release artefact. The indexer enumerates files, skipping binary blobs unless deep scan is enabled.
The 200+ pattern pack runs first, then entropy scoring over the remaining candidates. Deep scan opens binaries, JARs and compressed archives for the same treatment.
Each hit shows the file, the line, the rule that fired, a severity and a masked value. Nothing sensitive needs to be on screen to decide whether it is real.
Write JSON, SARIF or CSV. Pre-commit hooks and CI steps consume the same exit codes, so a new tracked secret can fail the commit rather than the release.
| Scan modes | On-demand, scheduled watching, deep scan |
|---|---|
| Watch mode | File-system watcher with instant alerts on new exposures |
| Report formats | JSON · SARIF · CSV |
| Hook support | Pre-commit, CI pipeline steps |
| Suppression | Per-file, per-project and global allowlists |
| Memory safety | Masked display, buffers zeroed on exit |
git rm --cached removes a file from tracking, not from previous commits.Who it is for
Six situations where a local scanner earns its licence fee once.
Prove that a repository handed over clean stayed clean, with a dated SARIF report instead of a promise in an email.
Flipping a private repository to public is the single most common way a project leaks. Scan before the toggle, and again in CI afterwards.
A desktop scanner your developers can run themselves beats a queue for the central tooling team, and never sees the source.
One-time licence, no seat subscription. Scan a client repository on the client's machine, offline, in minutes.
Deep scan reads inside ZIP, 7Z, TAR, GZ and JAR files, where abandoned credentials hide longest and are least likely to be rotated.
When a repository may already be public, the scanner's job is to enumerate every candidate so your rotation list is complete rather than guessed.
Prerequisites
| Requirement | Minimum | Recommended |
|---|---|---|
| Operating system | Windows 10 (64-bit) | Windows 11 (64-bit) |
| Target of a scan | A local folder or working tree | A Git working tree plus its checked-out artefacts, so build outputs get covered too |
| Privileges | Standard user account | No service install needed; run it as the developer who owns the repository |
| Network | None — every byte is processed locally | A connection only to download the installer and the rule-pack update |
| CI usage | Reports consumed as artefacts | Pre-commit hook plus a pipeline gate using the same exit codes |
| Existing scanners | Fine to run alongside Gitleaks or TruffleHog | Import their rule sets so findings converge instead of competing |
| Licence | $29 one-time per licence | Reinstall and move machines freely — there is no activation server to phone |
Context
Where each approach genuinely wins.
| Concern | Code Leak Detector | Hosted secret scanning | Regex in a build script |
|---|---|---|---|
| Where code goes | Nowhere — in-process on your machine | Uploaded or indexed by the provider | Local, but you maintain the rules |
| Rules maintenance | Versioned offline pack, importable third-party packs | Provider-managed and opaque | Whatever your team remembers to update |
| Archives and binaries | Deep scan inside ZIP, 7Z, TAR, GZ, JAR | Usually source files only | Rarely handled |
| Finding shape | Confirmed hits plus entropy candidates | Provider severity model | Whatever your regex matches |
| Blocking a commit | Pre-commit hook with exit codes | Platform-dependent, needs account/API | Possible, fully yours to break |
| Cost | $29 one-time (the suite's only paid tool) | Often per-seat SaaS | Engineering hours |
Questions
git rm --cached untracks a file without erasing previous commits. If the repository was ever public or shared, assume the secret is known.Documentation
Ready to scan
No subscriptions. No recurring fees. No account. One payment, permanent licence. Find exposed credentials at the keystroke — entirely on your machine.
| Version | v2.0.5 |
|---|---|
| Platform | Windows 10 / 11 |
| Price | $29 one-time |
| Telemetry | 0 bytes |