Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Discovery

Match exposed keys in files and git trees

Regex hunt for exposed API keys with exploitation hints.

Agent
Hunt for leaked API keys in repositoriesGet exploitation context for found keysUse custom regex for your own secrets

overview

What dora does

Point dora at a file or cloned git folder when regex matches for exposed API keys matter, and recognized types need exploitation hints for triage.

Load stack-specific patterns with --json. Pass path or type filters through --rg-arguments. Use -d or --verbose when custom rules still need tuning before a wide run.

Trickest runs dora as a managed Discovery node: folder or file in, folder and file out. Recover remote .git with dvcsripper-git first when needed. Prefer dumpsterdiver for entropy sweeps over mixed dumps.

source github.com/sdushantha/dora

use cases

Where dora fits

Hunt for leaked API keys in repositories

Scan a cloned git folder for credential patterns so cloud and service keys committed by mistake surface before an attacker finds them.

Get exploitation context for found keys

Let dora map recognized key types to exploitation methods, so a finding comes with how the key could be abused rather than only a string match.

Use custom regex for your own secrets

Load a JSON regex file with patterns for internal token formats so the scan catches credentials specific to your services.

Tune the search with ripgrep

Pass --rg-arguments to constrain path globs, file types, or case handling when a default sweep is too noisy.

reference

dora inputs and flags

7 inputs
NameTypeFlagDescription
gitFOLDER·Folder to test
fileFILE·File to test
json-regexFILE--jsonLoad regex data from a valid JSON file
rg-argumentsSTRING--rg-argumentsArguments you want to provide to ripgrep
verboseBOOLEAN--verboseVerbose mode
debugBOOLEAN-dDebug mode
no-colorBOOLEAN--no-colorNo color

Showing key inputs. dora exposes 7 inputs in total.

example

Run dora

dora · command
# scan a cloned repo for exposed keys with verbose match detaildora ./repo --verbose --no-color
sample output
[+] Scanning ./repo[!] AWS Access Key ID    File: ./repo/config/deploy.env:12    Match: AKIAIOSFODNN7EXAMPLE    Hint: enumerate IAM with sts:GetCallerIdentity[!] Slack Bot Token    File: ./repo/services/notify.py:88    Match: xoxb-000000000000-exampletoken    Hint: list channels / post messages via Web API[*] 2 key types matched across 1 path

guidance

Choosing dora

Use dora when a file or repository needs regex API-key hunting with exploitation context on hits. Prefer dumpsterdiver for broader secret detection across mixed data. Recover a remote .git with dvcsripper-git first when the tree is not local yet.

dumpsterdiver

Entropy and rule-based secret hunting across large data volumes. dora stays on regex key matches with exploitation hints.

dvcsripper-git

Rips a remote .git folder. Run it before dora when the repository is not already on disk.

faq

dora questions

Exposed API keys that match its regex set, in a single file or across a git repository folder. For recognized key types it also reports exploitation methods.

related

More Discovery tools

  1. apkurlgrep

    Extract URLs and endpoints from Android APK files.

  2. cariddi

    Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.

  3. crawlergo

    Browser-driven crawler that harvests requests for downstream scanners.

  4. dirsearch

    Web path scanner.

  5. fallparams

    Crawl pages, harvest potential parameters, write a custom wordlist.

  6. feroxbuster

    Recursive content discovery with smart defaults and rich response filters.

Run dora yourself

A git repository feeds dora, which matches its regex set against the content and writes the exposed keys, with exploitation context, as a queryable output.

Run dora in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.