Leaks
GitHub Secret Leaks
An API key usually leaks from somewhere other than your servers — a developer's personal repository, or the open project of an agency you worked with. A single `.env` file committed by mistake makes your database password public. Specula searches open repositories for files where your domain appears.
It follows your domain
The search runs on your domain itself rather than on repository names, so a leak is found even when it sits in an account you don't control.
Templates are told apart from leaks
`.env.example` files and placeholders like `changeme` or `your-api-key` are filtered out. An alert fires only for a value that looks real.
With the next step attached
The finding names which service the leaked key belongs to and which credential to revoke first.
old-agency/client-project
DB_HOST=db.specula.com.trDB_PASSWORD=••••••••••••API_KEY=your-api-key-here ← placeholder · ignored
2 real values · 1 template filtered · revocation advised
Other features
Run this check on your own domain.
Add a domain and Specula finishes the first scan within minutes. No credit card needed.