Use Case: Code Security
Leaked API key detection
A contractor pushed code to their personal GitHub containing your production Stripe live key. ManySignal had an alert open 47 seconds later. The key was revoked before any charge was processed.
The attacker's scanner is faster than yours
Public GitHub push events are an open fire hose. Every second, thousands of commits are pushed to public repositories worldwide. Automated tools used by security researchers and attackers alike scan this stream for credential patterns in real time. If your organization has a leaked API key on public GitHub, the window between exposure and exploitation is measured in seconds to minutes — not hours.
The most common leak vector is not malicious intent — it's a developer testing an integration locally, committing the .env file before realizing it contains a production key, and pushing to their personal repository. The fix is simple (revoke and rotate) but only if you find out in time.
rule: api_key_public_exposure
type: stream_monitor + pattern_match
sources:
- github_public_event_stream (via GHArchive / webhooks)
- gitlab_public_events
- pastebin_scraper
trigger:
- condition: |
secret_pattern_match(commit.diff) == true
AND secret.confidence > 0.9
AND repository.visibility == "public"
enrichments:
- secret_validation: provider_api_check
- exposure_time: time_since_push
- repository_owner: org_affiliation_check
- revocation_action: provider_specific_api
mitre: T1552.001 (Credentials in Files), T1119 (Automated Collection)MITRE ATT&CK mapping
Leaked API key FAQ
How does ManySignal detect leaked API keys on public GitHub beyond just watching your own repos?
ManySignal connects to GitHub's public push event stream and monitors for patterns matching your organization's API key formats. This includes Stripe keys prefixed with your account ID, Google service account emails containing your domain, and custom API key patterns specific to your platform. New public commits containing these patterns trigger an alert before most scanners find them.
What's the typical window between GitHub commit and attacker exploitation?
Research from GitGuardian shows that automated scanners identify leaked secrets on public GitHub within 4-8 seconds of the push event. Attackers using these tools can attempt to use a leaked key within minutes. ManySignal's detection runs on the same event stream, aiming for sub-60-second alert time to give the security team a head start.
Can ManySignal automatically revoke API keys when they're detected as leaked?
For supported providers — AWS IAM (via STS deactivation), GitHub PATs (via GitHub API), Stripe keys (via Stripe API), and Twilio keys (via Twilio API) — ManySignal can revoke the key as an autonomous response action. The key revocation happens in parallel with the analyst notification, minimizing the exposure window.
Does this work for keys leaked in conference talks, blog posts, or documentation?
Public web scanning is a separate capability from GitHub monitoring. ManySignal integrates with services that scan documentation sites, blog platforms, and paste sites for credential patterns. However, real-time detection is most reliable for code repository platforms where event-stream monitoring is available.
Beat attackers to leaked API keys by seconds
Public GitHub event stream monitoring with automatic key revocation for supported providers.