60 providers + 8 database families. Expanded GitHub search dorks.
Original six · AI & inference · Media & voice · Agents · Databases · Search anatomy
This is a collection of GitHub dorks: advanced search queries that combine file paths, credential-field names, token patterns, and provider context to identify potential secret exposures in indexed code. Paste a dork into github.com/search and select Code, or use its direct search link.
File locations → credential names → signature or assignment → provider context.
The combined structure from the original reference is the foundation of this collection. Each entry has a fully expanded expression, followed by a shorter focused query. Both are for github.com/search with Code selected.
| Layer | Purpose | Example |
|---|---|---|
| FILES | Configurations, logs, backups, and key files | path:*.json OR path:*.env OR path:.env.* |
| FIELDS | Generic names plus provider-specific aliases | api_key OR access_token OR ANTHROPIC_API_KEY |
| SIGNAL | Token-family clue or literal-looking assignment | "sk-ant-" or an assignment regex |
| CONTEXT | Disambiguates shared token prefixes | anthropic OR claude |
Full expression: retains all 23 original extensions and all 13 original credential names, adds .env.*, and combines the provider signal in one expression. Focused search: shorter, broader, and below 256 characters; use it if GitHub rejects the full expression's length. Removing file filters also finds source-code occurrences.
No owner/repository placeholders are embedded. These are search heuristics, not credential validators. A matching example, placeholder, or unrelated value can still be a false positive. Review exposures only within your authorized scope.
01 OpenAI · 02 GitHub · 03 Slack · 04 Google APIs · 05 Square · 06 Shopify
07 Anthropic · 08 Google Gemini · 09 xAI · 10 DeepSeek · 11 Mistral AI · 12 Cohere · 13 Groq · 14 Cerebras · 15 SambaNova · 16 Together AI · 17 Fireworks AI · 18 OpenRouter · 19 Hugging Face · 20 Replicate · 21 Perplexity · 22 AI21 · 23 NVIDIA NIM · 24 DeepInfra · 25 Novita AI
26 fal · 27 Black Forest Labs · 28 Stability AI · 29 Runway · 30 Luma AI · 31 ElevenLabs · 32 Cartesia · 33 Deepgram · 34 AssemblyAI · 35 Speechmatics · 36 Resemble AI · 37 Hume AI
38 Tavily · 39 Exa · 40 Firecrawl · 41 Brave Search · 42 SerpApi · 43 Browserbase · 44 E2B · 45 Composio
Retrieval, data & observability
46 Pinecone · 47 Qdrant · 48 Weaviate · 49 Voyage AI · 50 Jina AI · 51 LangSmith · 52 Langfuse · 53 Weights & Biases
Cloud & application infrastructure
54 AWS / Bedrock · 55 Azure OpenAI · 56 Google Cloud / Vertex AI · 57 Cloudflare Workers AI · 58 Vercel AI Gateway · 59 Supabase · 60 Stripe
The six provider families from the source reference, kept together. Added clues include OpenAI project/service-account/admin families, fine-grained GitHub PATs, Slack app-level tokens, and Square’s EAAA family. Historical clues remain included.
Token-family clues + provider context
sk-proj- · sk-svcacct- · sk-admin- · sk-
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("sk-proj-" OR "sk-svcacct-" OR "sk-admin-" OR "sk-") AND ("openai" OR "gpt")
Focused query
content:/sk-proj-|sk-svcacct-|sk-admin-|sk-/ ("openai" OR "gpt")
↗ Run focused search · Run full expression · Provider documentation
Project and administrative credentials have different privileges; do not assume a fixed key length.
Token-family clues + provider context
ghp_ · gho_ · ghu_ · ghs_ · ghr_ · github_pat_
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("ghp_" OR "gho_" OR "ghu_" OR "ghs_" OR "ghr_" OR "github_pat_") AND ("github" OR "oauth")
Focused query
content:/ghp_|gho_|ghu_|ghs_|ghr_|github_pat_/ ("github" OR "oauth")
↗ Run focused search · Run full expression · Provider documentation
Include classic, fine-grained, OAuth, App, and refresh-token families.
Token-family clues + provider context
xox · xapp-
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("xox" OR "xapp-") AND ("slack")
Focused query
content:/xox|xapp-/ ("slack")
↗ Run focused search · Run full expression · Provider documentation
Bot, user, app-level, and other token types have different privileges.
Token-family clues + provider context
AIza
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("AIza") AND ("google" OR "googleapis")
Focused query
content:/AIza/ ("google" OR "googleapis")
↗ Run focused search · Run full expression · Provider documentation
API restrictions and application restrictions matter; a match is not proof of compromise.
Token-family clues + provider context
sq0atp- · sq0csp- · EAAA
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("sq0atp-" OR "sq0csp-" OR "EAAA") AND ("square" OR "oauth")
Focused query
content:/sq0atp-|sq0csp-|EAAA/ ("square" OR "oauth")
↗ Run focused search · Run full expression · Provider documentation
Access tokens and application secrets should be reviewed separately.
Token-family clues + provider context
shpss_ · shpat_ · shpca_ · shppa_
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("shpss_" OR "shpat_" OR "shpca_" OR "shppa_") AND ("shopify")
Focused query
content:/shpss_|shpat_|shpca_|shppa_/ ("shopify")
↗ Run focused search · Run full expression · Provider documentation
Include app secrets and historical private/custom-app token families.
Token-family clues + provider context
sk-ant-api03- · sk-ant-admin01- · sk-ant-
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("sk-ant-api03-" OR "sk-ant-admin01-" OR "sk-ant-") AND ("anthropic" OR "claude")
Focused query
content:/sk-ant-api03-|sk-ant-admin01-|sk-ant-/ ("anthropic" OR "claude")
↗ Run focused search · Run full expression · Provider documentation
Claude API credentials are separate from consumer chat subscriptions.
Token-family clues + provider context
AIza
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("AIza") AND ("gemini" OR "generativelanguage")
Focused query
content:/AIza/ ("gemini" OR "generativelanguage")
↗ Run focused search · Run full expression · Provider documentation
A Google key prefix alone cannot identify the enabled API or its restrictions.
Named credential assignment; no assumed provider prefix
XAI_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR XAI_API_KEY) AND content:/(?i)(XAI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(XAI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check inference credentials separately from management credentials.
Named credential assignment; no assumed provider prefix
DEEPSEEK_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR DEEPSEEK_API_KEY) AND content:/(?i)(DEEPSEEK_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(DEEPSEEK_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
OpenAI-compatible clients may store this credential under a generic variable name.
Named credential assignment; no assumed provider prefix
MISTRAL_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR MISTRAL_API_KEY) AND content:/(?i)(MISTRAL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(MISTRAL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Search both direct integrations and model-router configuration.
Named credential assignment; no assumed provider prefix
CO_API_KEY · COHERE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR CO_API_KEY OR COHERE_API_KEY) AND content:/(?i)(CO_API_KEY|COHERE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(CO_API_KEY|COHERE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Include embeddings and reranking integrations in the review.
Named credential assignment; no assumed provider prefix
GROQ_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR GROQ_API_KEY) AND content:/(?i)(GROQ_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(GROQ_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Inference credentials may appear in OpenAI-compatible client configuration.
Named credential assignment; no assumed provider prefix
CEREBRAS_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR CEREBRAS_API_KEY) AND content:/(?i)(CEREBRAS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(CEREBRAS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check low-latency inference examples and deployment configuration.
Named credential assignment; no assumed provider prefix
SAMBANOVA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR SAMBANOVA_API_KEY) AND content:/(?i)(SAMBANOVA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(SAMBANOVA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Endpoint context helps distinguish generic API-key names.
Named credential assignment; no assumed provider prefix
TOGETHER_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR TOGETHER_API_KEY) AND content:/(?i)(TOGETHER_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(TOGETHER_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Review fine-tuning and inference jobs as well as application code.
Named credential assignment; no assumed provider prefix
FIREWORKS_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR FIREWORKS_API_KEY) AND content:/(?i)(FIREWORKS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(FIREWORKS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check both hosted model calls and deployment scripts.
Named credential assignment; no assumed provider prefix
OPENROUTER_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR OPENROUTER_API_KEY) AND content:/(?i)(OPENROUTER_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(OPENROUTER_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
A routing credential can expose access to multiple upstream model families.
Token-family clues + provider context
hf_ · api_org_
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("hf_" OR "api_org_") AND ("huggingface" OR "HF_TOKEN")
Focused query
content:/hf_|api_org_/ ("huggingface" OR "HF_TOKEN")
↗ Run focused search · Run full expression · Provider documentation
Check token permissions: model downloads, inference, and repository writes differ.
Named credential assignment; no assumed provider prefix
REPLICATE_API_TOKEN
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR REPLICATE_API_TOKEN) AND content:/(?i)(REPLICATE_API_TOKEN)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(REPLICATE_API_TOKEN)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Inspect image and video workflows in addition to language-model code.
Token-family clues + provider context
pplx-
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret) AND ("pplx-") AND ("perplexity" OR "pplx")
Focused query
content:/pplx-/ ("perplexity" OR "pplx")
↗ Run focused search · Run full expression · Provider documentation
Search and answer-generation integrations may use different wrapper names.
Named credential assignment; no assumed provider prefix
AI21_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR AI21_API_KEY) AND content:/(?i)(AI21_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(AI21_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check notebooks and application configuration for credentials.
Named credential assignment; no assumed provider prefix
NVIDIA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR NVIDIA_API_KEY) AND content:/(?i)(NVIDIA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(NVIDIA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Hosted API credentials and self-hosted deployment credentials need separate review.
Named credential assignment; no assumed provider prefix
DEEPINFRA_API_TOKEN · DEEPINFRA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR DEEPINFRA_API_TOKEN OR DEEPINFRA_API_KEY) AND content:/(?i)(DEEPINFRA_API_TOKEN|DEEPINFRA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(DEEPINFRA_API_TOKEN|DEEPINFRA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
An OpenAI-compatible base URL may be the strongest provider clue.
Named credential assignment; no assumed provider prefix
NOVITA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR NOVITA_API_KEY) AND content:/(?i)(NOVITA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(NOVITA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Search both model inference and media-generation integrations.
Named credential assignment; no assumed provider prefix
FAL_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR FAL_KEY) AND content:/(?i)(FAL_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(FAL_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check server code and workflow exports; media-generation credentials should stay server-side.
Named credential assignment; no assumed provider prefix
BFL_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR BFL_API_KEY) AND content:/(?i)(BFL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(BFL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
FLUX integrations may use an x-key header instead of a Bearer header.
Named credential assignment; no assumed provider prefix
STABILITY_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR STABILITY_API_KEY) AND content:/(?i)(STABILITY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(STABILITY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Look at creative tools, notebooks, and exported workflow configurations.
Named credential assignment; no assumed provider prefix
RUNWAYML_API_SECRET · RUNWAY_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR RUNWAYML_API_SECRET OR RUNWAY_API_KEY) AND content:/(?i)(RUNWAYML_API_SECRET|RUNWAY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(RUNWAYML_API_SECRET|RUNWAY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Include background rendering workers and job queues in the audit.
Named credential assignment; no assumed provider prefix
LUMAAI_API_KEY · LUMA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR LUMAAI_API_KEY OR LUMA_API_KEY) AND content:/(?i)(LUMAAI_API_KEY|LUMA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(LUMAAI_API_KEY|LUMA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Dream Machine integrations may store credentials in backend worker configuration.
Named credential assignment; no assumed provider prefix
ELEVENLABS_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR ELEVENLABS_API_KEY) AND content:/(?i)(ELEVENLABS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(ELEVENLABS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
The xi-api-key header is useful context when environment names are absent.
Named credential assignment; no assumed provider prefix
CARTESIA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR CARTESIA_API_KEY) AND content:/(?i)(CARTESIA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(CARTESIA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Review realtime voice integrations and WebSocket setup code.
Named credential assignment; no assumed provider prefix
DEEPGRAM_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR DEEPGRAM_API_KEY) AND content:/(?i)(DEEPGRAM_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(DEEPGRAM_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Streaming and prerecorded audio integrations can share credentials.
Named credential assignment; no assumed provider prefix
ASSEMBLYAI_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR ASSEMBLYAI_API_KEY) AND content:/(?i)(ASSEMBLYAI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(ASSEMBLYAI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Inspect transcription workers and upload-processing configuration.
Named credential assignment; no assumed provider prefix
SPEECHMATICS_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR SPEECHMATICS_API_KEY) AND content:/(?i)(SPEECHMATICS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(SPEECHMATICS_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Endpoint matching is broad; combine it with authentication terms.
Named credential assignment; no assumed provider prefix
RESEMBLE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR RESEMBLE_API_KEY) AND content:/(?i)(RESEMBLE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(RESEMBLE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Review speech-generation and voice-management integrations.
Named credential assignment; no assumed provider prefix
HUME_API_KEY · HUME_SECRET_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR HUME_API_KEY OR HUME_SECRET_KEY) AND content:/(?i)(HUME_API_KEY|HUME_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(HUME_API_KEY|HUME_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
API keys and secret keys are distinct credentials; inspect both.
Named credential assignment; no assumed provider prefix
TAVILY_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR TAVILY_API_KEY) AND content:/(?i)(TAVILY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(TAVILY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Agent web-search tools often introduce this credential through environment files.
Named credential assignment; no assumed provider prefix
EXA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR EXA_API_KEY) AND content:/(?i)(EXA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(EXA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Review search, content retrieval, and research-agent integrations.
Named credential assignment; no assumed provider prefix
FIRECRAWL_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR FIRECRAWL_API_KEY) AND content:/(?i)(FIRECRAWL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(FIRECRAWL_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check ingestion jobs and crawler configuration.
Named credential assignment; no assumed provider prefix
BRAVE_API_KEY · BRAVE_SEARCH_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR BRAVE_API_KEY OR BRAVE_SEARCH_API_KEY) AND content:/(?i)(BRAVE_API_KEY|BRAVE_SEARCH_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(BRAVE_API_KEY|BRAVE_SEARCH_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
The X-Subscription-Token header is another useful clue.
Named credential assignment; no assumed provider prefix
SERPAPI_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR SERPAPI_API_KEY) AND content:/(?i)(SERPAPI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(SERPAPI_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Credentials in URL query parameters can also surface in logs.
Named credential assignment; no assumed provider prefix
BROWSERBASE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR BROWSERBASE_API_KEY) AND content:/(?i)(BROWSERBASE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(BROWSERBASE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Project IDs are identifiers; distinguish them from API keys.
Named credential assignment; no assumed provider prefix
E2B_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR E2B_API_KEY) AND content:/(?i)(E2B_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(E2B_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Audit sandbox-launch code and agent deployment configuration.
Named credential assignment; no assumed provider prefix
COMPOSIO_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR COMPOSIO_API_KEY) AND content:/(?i)(COMPOSIO_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(COMPOSIO_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Review connected-account authorization as well as the platform API key.
Named credential assignment; no assumed provider prefix
PINECONE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR PINECONE_API_KEY) AND content:/(?i)(PINECONE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(PINECONE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Vector data can contain private application content; review key permissions.
Named credential assignment; no assumed provider prefix
QDRANT_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR QDRANT_API_KEY) AND content:/(?i)(QDRANT_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(QDRANT_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Cloud cluster URLs and API keys are different fields.
Named credential assignment; no assumed provider prefix
WEAVIATE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR WEAVIATE_API_KEY) AND content:/(?i)(WEAVIATE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(WEAVIATE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check both database access and upstream model-provider credentials.
Named credential assignment; no assumed provider prefix
VOYAGE_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR VOYAGE_API_KEY) AND content:/(?i)(VOYAGE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(VOYAGE_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Embedding and reranking jobs frequently run outside the main application.
Named credential assignment; no assumed provider prefix
JINA_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR JINA_API_KEY) AND content:/(?i)(JINA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(JINA_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Inspect document ingestion, search, and embedding services.
Named credential assignment; no assumed provider prefix
LANGSMITH_API_KEY · LANGCHAIN_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR LANGSMITH_API_KEY OR LANGCHAIN_API_KEY) AND content:/(?i)(LANGSMITH_API_KEY|LANGCHAIN_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(LANGSMITH_API_KEY|LANGCHAIN_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Old and new configuration names may coexist in application repositories.
Named credential assignment; no assumed provider prefix
LANGFUSE_SECRET_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR LANGFUSE_SECRET_KEY) AND content:/(?i)(LANGFUSE_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(LANGFUSE_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Distinguish the secret key from the companion public key.
Named credential assignment; no assumed provider prefix
WANDB_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR WANDB_API_KEY) AND content:/(?i)(WANDB_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(WANDB_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Training and experiment-tracking credentials may live in notebooks or CI files.
Named credential assignment; no assumed provider prefix
AWS_ACCESS_KEY_ID · AWS_SECRET_ACCESS_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR AWS_ACCESS_KEY_ID OR AWS_SECRET_ACCESS_KEY) AND content:/(?i)(AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
An access-key ID alone is not a complete credential; also review session tokens and IAM roles.
Named credential assignment; no assumed provider prefix
AZURE_OPENAI_API_KEY · AZURE_OPENAI_ENDPOINT
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR AZURE_OPENAI_API_KEY OR AZURE_OPENAI_ENDPOINT) AND content:/(?i)(AZURE_OPENAI_API_KEY|AZURE_OPENAI_ENDPOINT)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(AZURE_OPENAI_API_KEY|AZURE_OPENAI_ENDPOINT)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
An endpoint is not a secret. Entra ID authentication uses a different credential flow.
Named credential assignment; no assumed provider prefix
GOOGLE_APPLICATION_CREDENTIALS · private_key_id
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR GOOGLE_APPLICATION_CREDENTIALS OR private_key_id) AND content:/(?i)(GOOGLE_APPLICATION_CREDENTIALS|private_key_id)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(GOOGLE_APPLICATION_CREDENTIALS|private_key_id)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
A credential file path is not a key. Review service-account JSON and workload identity separately.
Named credential assignment; no assumed provider prefix
CLOUDFLARE_API_TOKEN
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR CLOUDFLARE_API_TOKEN) AND content:/(?i)(CLOUDFLARE_API_TOKEN)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(CLOUDFLARE_API_TOKEN)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Check account permissions and token scope; account IDs are not secret credentials.
Named credential assignment; no assumed provider prefix
AI_GATEWAY_API_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR AI_GATEWAY_API_KEY) AND content:/(?i)(AI_GATEWAY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(AI_GATEWAY_API_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Gateway API keys and deployment identity authentication have different lifecycles.
Named credential assignment; no assumed provider prefix
SUPABASE_SERVICE_ROLE_KEY · SUPABASE_SECRET_KEY
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR SUPABASE_SERVICE_ROLE_KEY OR SUPABASE_SECRET_KEY) AND content:/(?i)(SUPABASE_SERVICE_ROLE_KEY|SUPABASE_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(SUPABASE_SERVICE_ROLE_KEY|SUPABASE_SECRET_KEY)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Publishable and legacy anon keys are designed for client use; elevated secret keys are not.
Named credential assignment; no assumed provider prefix
STRIPE_SECRET_KEY · STRIPE_WEBHOOK_SECRET
Full expression
(path:*.xml OR path:*.json OR path:*.properties OR path:*.sql OR path:*.txt OR path:*.log OR path:*.tmp OR path:*.backup OR path:*.bak OR path:*.enc OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.cfg OR path:*.env OR path:*.envrc OR path:*.prod OR path:*.secret OR path:*.private OR path:*.key OR path:.env.*) AND (access_key OR secret_key OR access_token OR api_key OR apikey OR api_secret OR apiSecret OR app_secret OR application_key OR app_key OR appkey OR auth_token OR authsecret OR STRIPE_SECRET_KEY OR STRIPE_WEBHOOK_SECRET) AND content:/(?i)(STRIPE_SECRET_KEY|STRIPE_WEBHOOK_SECRET)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
Focused query
content:/(?i)(STRIPE_SECRET_KEY|STRIPE_WEBHOOK_SECRET)["']?[ \t]*[:=][ \t]*["']?[a-z0-9_.-]{16,}/
↗ Run focused search · Run full expression · Provider documentation
Secret API keys and webhook signing secrets have different purposes; publishable keys are not secrets.
08 database families · credential-bearing URLs, DSNs, and paired authentication settings
Connection strings can combine a host, database, username, and password. They can also be harmless routing information with authentication supplied elsewhere. No query here proves full access. Privileges depend on the database account's grants, roles, network controls, and other authentication requirements.
Full expressions combine file filters, connection syntax, and authentication/configuration context. Focused queries broaden coverage to source files and alternate variable names. All examples below are fully redacted format illustrations—not captured credentials or verified findings.
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"postgres://" OR content:"postgresql://" OR content:"jdbc:postgresql:") AND (DATABASE_URL OR POSTGRES_URL OR PGDATABASE OR password OR username)
Focused query
(content:"postgres://" OR content:"postgresql://" OR content:"jdbc:postgresql:")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: postgresql://[USER]:[REDACTED]@[HOST]:5432/[DATABASE]
Also inspect libpq keyword strings: host, dbname, user, and password may appear separately. A postgres username is only a privilege clue; inspect role attributes, grants, and row-level security.
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"mysql://" OR content:"mariadb://" OR content:"jdbc:mysql:" OR content:"jdbc:mariadb:") AND (DATABASE_URL OR MYSQL_URL OR MARIADB_URL OR password OR username)
Focused query
(content:"mysql://" OR content:"mariadb://" OR content:"jdbc:mysql:" OR content:"jdbc:mariadb:")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: mysql://[USER]:[REDACTED]@[HOST]:3306/[DATABASE]
A root account name warrants review but is not proof of reachable access. Check host restrictions, grants, and whether the password is stored separately.
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"mongodb://" OR content:"mongodb+srv://") AND (MONGODB_URI OR MONGO_URI OR DATABASE_URL OR authSource OR password)
Focused query
(content:"mongodb://" OR content:"mongodb+srv://")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: mongodb+srv://[USER]:[REDACTED]@[HOST]/[DATABASE]
authSource=admin identifies the authentication database, not an administrative role. Review assigned roles and network restrictions.
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"redis://" OR content:"rediss://") AND (REDIS_URL OR REDIS_URI OR CACHE_URL OR password OR username)
Focused query
(content:"redis://" OR content:"rediss://")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: rediss://[USER]:[REDACTED]@[HOST]:6379/0
Check ACL permissions, TLS, and network exposure. Some clients use a password-only URL or separate username/password fields; a database number is not a permission boundary.
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"jdbc:sqlserver:" OR content:"mssql://" OR content:"sqlserver://" OR content:"Initial Catalog") AND (content:"Password" OR content:"PWD" OR content:"User ID" OR content:"UID")
Focused query
(content:"jdbc:sqlserver:" OR content:"mssql://" OR content:"sqlserver://" OR content:"Initial Catalog")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: Server=[HOST];Database=[DATABASE];User ID=[USER];Password=[REDACTED]
Include ODBC and ADO.NET property strings. Integrated Security or Trusted_Connection can use the process identity instead of a password; sa is a review clue, not proof of authentication or sysadmin access.
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"jdbc:oracle:" OR content:"oracle://" OR content:"oracle+oracledb://" OR content:"DESCRIPTION=") AND (DATABASE_URL OR ORACLE_DSN OR password OR content:"User Id")
Focused query
(content:"jdbc:oracle:" OR content:"oracle://" OR content:"oracle+oracledb://" OR content:"DESCRIPTION=")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: oracle+oracledb://[USER]:[REDACTED]@[HOST]:1521/?service_name=[SERVICE]
A TNS descriptor usually identifies a destination rather than carrying authentication. Credentials may be separate or held in a wallet; SYSDBA requires explicit authorization and cannot be inferred from a DSN.
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"clickhouse://" OR content:"clickhouses://" OR content:"jdbc:clickhouse:") AND (CLICKHOUSE_URL OR DATABASE_URL OR password OR username)
Focused query
(content:"clickhouse://" OR content:"clickhouses://" OR content:"jdbc:clickhouse:")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: clickhouse://[USER]:[REDACTED]@[HOST]:9000/[DATABASE]
Schemes and ports depend on the driver. Also inspect HTTP client settings with separate user/password fields. A default username does not establish broad grants.
Full expression
(path:*.env OR path:.env.* OR path:*.json OR path:*.yml OR path:*.yaml OR path:*.toml OR path:*.ini OR path:*.config OR path:*.conf OR path:*.properties OR path:*.sql OR path:*.log OR path:*.bak OR path:*.backup) AND (content:"neo4j://" OR content:"neo4j+s://" OR content:"bolt://" OR content:"bolt+s://") AND (NEO4J_AUTH OR NEO4J_PASSWORD OR password OR basic_auth)
Focused query
(content:"neo4j://" OR content:"neo4j+s://" OR content:"bolt://" OR content:"bolt+s://")
↗ Run focused search · Run full expression · Connection documentation
Redacted format example: NEO4J_URI=neo4j+s://[HOST]:7687; NEO4J_AUTH=[USER]/[REDACTED]
Neo4j drivers commonly keep authentication separate from the connection URI. Inspect the paired auth configuration and database roles; finding a Bolt URI alone is not a credential exposure.
| Finding | What it establishes | What still needs review |
|---|---|---|
| Username and password embedded in a URL | Potential credential material in a configuration value | Whether it is a placeholder, active, reachable, and authorized for the target database |
root ,postgres ,sa , orSYS username |
A potentially sensitive account name | Actual roles, grants, host restrictions, and authentication mode |
authSource=admin |
MongoDB authentication database selection | The authenticated user's assigned roles |
sslmode=require ,rediss:// , or a TLS-enabled scheme |
A transport configuration clue | Certificate verification, authentication, and privileges |
| URI plus a separate password or auth field | Potentially related connection settings in the same file | Whether the fields actually belong together |
For an authorized report, redact the complete credential value and any sensitive host/database identifiers before publishing. Rotate exposed credentials through the database or managed-service controls; changing a connection-string variable alone does not revoke the underlying account.
Distinctive prefixes are useful clues, but do not establish whether a credential is real, active, or associated with the provider named elsewhere in a file. The original OpenAI fixed-length sk- pattern only describes a historical shape; it is not a universal modern-key rule.
Historical OpenAI shape — not a modern-key validator:
content:/sk-[A-Za-z0-9]{48}/ (openai OR gpt)
Prefix clues are informed by the original reference and Gitleaks' published detection rules. They intentionally omit claims of complete token validation. The source reference's OpenAI regex contribution credited fkulakov.
For providers without a confirmed distinctive prefix in this guide, the query looks for a credential field followed by : or = and at least 16 token-like characters. That threshold is a noise-reduction heuristic, not an official key length.
These expressions cover common .env, JSON, YAML, and source-code assignments. They can miss short values, multiline values, punctuation outside the chosen character set, alternate variable names, custom proxies, and credentials passed directly to a client constructor. Unquoted references such as process.env.SOME_LONG_VARIABLE can still match. Check the source context.
The full expressions focus on configuration and auxiliary files, as the original reference does. This excludes many .py, .js, .ts, .ipynb, and extensionless files. Use the focused query to include those locations, or add the extensions relevant to your application. A .enc filename does not make encrypted content searchable.
These recipes locate potentially relevant files and authentication references. They do not assert that a matching file contains a literal secret.
| Surface | Copy into GitHub Code Search |
|---|---|
| MCP configuration | (path:mcp.json OR path:claude_desktop_config.json) (api_key OR token OR secret) |
| Notebooks | path:*.ipynb (api_key OR access_token OR Authorization) |
| CI workflows | path:.github/workflows (api_key OR token OR secret) |
| Container configuration | (path:Dockerfile OR path:docker-compose OR path:compose.yaml) (api_key OR token OR secret) |
| Environment variants | `path:/(^ |
| Saved logs | (path:*.log OR path:*.txt) (Authorization OR api_key OR access_token) |
| Backups | (path:*.bak OR path:*.backup OR path:*.tmp) (api_key OR token OR secret) |
| Browser-exposed names | (NEXT_PUBLIC_ OR VITE_ OR PUBLIC_) (SECRET OR API_KEY) |
Illustrative classification examples — not harvested credentials or live findings. Values below are placeholders; no validity checks were performed.
| Snippet | Classification | Why |
|---|---|---|
ANTHROPIC_API_KEY="[REDACTED]" |
Needs context | A literal assignment is worth reviewing, but masking alone proves nothing about the original value. |
os.environ["ANTHROPIC_API_KEY"] |
Reference only | Reads a value from the environment. The value is not present here. |
api_key="your-api-key" |
Example placeholder | Documentation template, not evidence of an exposed credential. |
${{ secrets.OPENAI_API_KEY }} |
Secret-store reference | Refers to a CI secret without revealing its stored value. |
SUPABASE_SERVICE_ROLE_KEY="[REDACTED]" |
Review permissions | Elevated server-side access differs from a client-facing publishable key. |
For an authorized report, mask the entire value, including any appearance in a URL, screenshot, log, or surrounding line. Record the provider, file location, classification, and remediation status. Do not label a match “live” unless an authorized assessment establishes that fact.
| Group | Extensions |
|---|---|
| Structured data | .xml ·.json ·.properties ·.sql |
| Text, logs, temporary files | .txt ·.log ·.tmp |
| Backups and encrypted-file names | .backup ·.bak ·.enc |
| Configuration | .yml ·.yaml ·.toml ·.ini ·.config ·.conf ·.cfg |
| Environments and credential files | .env ·.envrc ·.prod ·.secret ·.private ·.key |
| Added coverage | .env.* , such as.env.local and.env.production |
| Family | Names |
|---|---|
| Access | access_key ·secret_key ·access_token |
| API | api_key ·apikey ·api_secret ·apiSecret |
| Application | app_secret ·application_key ·app_key ·appkey |
| Authentication | auth_token ·authsecret |
GitHub combines terms at the file level; two terms can occur on unrelated lines. A compound query is not proof that a key, provider label, and endpoint belong to the same integration. Search coverage is limited by indexing and does not replace a Git-history audit. Empty results do not establish that a repository is clean.
Browser Code Search supports Boolean operators, content qualifiers, and slash-delimited regex. The CLI and REST API may behave differently. See GitHub's syntax reference and search coverage.
Revoke or rotate → update dependents → review usage → remove exposure → prevent recurrence.
Deleting a committed value does not revoke it. Use the provider's controls to rotate it, review permissions and usage, then handle current files and history as appropriate. Report a third party's accidental exposure privately without publishing or testing the credential.
Created by AKCodez. Based on the search structure and factual provider/parameter coverage in win3zz's original reference, with expanded AI-provider coverage and independently written explanations. No original screenshot or exposed credential is reproduced. This is a standalone gist.
Original resource links: Online IDE Search · Keyhacks · Google Hacking Database.
Detection references: Gitleaks · TruffleHog · GitHub supported secret patterns.
SECRET GRAVEYARD
60 providers & platforms + 8 database families · GitHub dork collection · Updated October 18, 2026