Never hardcode a credential
Load secrets from environment variables or a manager — AWS Secrets Manager, HashiCorp Vault.
PRINT — · LOADING
How many AI API keys are sitting in public GitHub code?
Counted every month, across four providers. These are key-prefix matches in public code — an upper bound, not verified live keys.
—
Potential prefix matches
——
Since first measurement
—
—
—
—
Twelve months, four prefixes
First measurement against the latest. Phosphor = fewer, amber = more. The span between is hatched — it was not observed.
Scroll the chart sideways to read it →
—
ai-keys-leaks.begimher.com
One shape per prefix
Shared log scale — one gridline is ten times. The dotted rule is the July 2025 level.
VOLATILE marks a month-over-month change above 50% · GitHub reports search totals as estimates
What this measures
Four queries, run once a month. Nothing but counts is stored.
This count is
✗ not unique keys
✗ not verified-active keys
✗ not a count of repositories
✗ not a leak rate — it is a stock, not a flow
What is AI Leak Watch?
An AWS Lambda runs on the first of each month, asks the GitHub Code Search API how many public results contain each provider's key prefix, and publishes the counts as JSON. Only counts, timestamps and the query strings are stored — never search results, repository names, file contents or key material.
Are these confirmed leaked keys?
No. They are literal substring matches in public code. Docs, examples, test fixtures, revoked keys and the same key duplicated across forks all count. Treat the total as an upper bound on exposure, not a count of live credentials.
Why is one prefix most of the total?
AIza is the prefix for every Google API key — including the
Firebase and Maps browser keys Google documents as
safe to ship in client code.
That query is — of the headline. Excluding it, the count is
— — and that residual has fallen, not risen.
Why is there a gap in the record?
The collector was not running for part of the record, so those months have no snapshot. No chart on this page draws a line through them.
Why is the OpenAI row flagged?
The 2025 baseline appears to have also counted the legacy sk-[A-Za-z0-9]{40}
pattern, which is no longer collected. Its apparent decline is partly a change in the
question — so the comparison is suppressed rather than shown.
How to keep your keys out of here
Scan before you push
ASH runs SAST, SCA, IaC and secrets scanners locally; TruffleHog verifies whether a key is live.
Rotate first, then rewrite
Revoke at the provider. Deleting the commit does nothing on its own — public code is cloned, indexed and scraped within minutes.
Further reading
It's 2025. Why Are We Still Pushing API Keys to GitHub?
The essay behind this dashboard — why this keeps happening in the age of vibe coding, what changes when an API key stops being a key to a model and becomes the key to an inbox, a database or an MCP server, and what actually works.