Hunt leaked secrets across GitHub orgs and web responses

leakos hunts for leaked credentials in two places: a GitHub organization's code and the HTTP responses of a list of URLs. It orchestrates gitleaks and trufflehog under one interface, so a single run checks an org's repositories, its members' repositories, and the bodies of web responses for keys, tokens, and other secrets, then merges the results.

You scope it with comma-separated org, user, or repo names, or supply a file of URLs to scan their responses. A GitHub token widens the search across an org's members and dodges API rate limits. Switches let you skip an engine, keep only verified findings, cap how many URLs to check, or extend detection with your own regexes.

On Trickest, leakos is a Static Code Analysis node that takes targets and writes a file and a folder of findings. Run it against an org you own to catch exposed secrets before attackers do, or point it at the URLs a crawler discovered to find credentials leaking in responses.