.svg)
Operate · Secrets
Know which leaked keys still work, and rotate those first.
Heeler finds keys in code and git history, tests each with its provider, and routes live ones to the owner.
A deleted key is still leaked.
Git history keeps every key.
Git history · every branch
Full git history909 formatsArchivesAgent sessions
Validate
We prove which keys still work.
Fakes stripped offline. Real keys checked live, read-only.
- Looks like a secretPattern match
- Checksum verifiedOffline · nothing sent · fakes dropped
- Live check, read-onlyCloud, SaaS and AI APIs · databases
- EvidenceThe provider's own response
AWS access key
AKIA…7Q3FChecked with AWS
LiveRotate Now
- Identity
- user/ci-deploy
- Account
- 4821…9930
GitHub token
github_pat_…Checked with GitHub
LiveRotate Now
- Owner
- ci-bot · acme-org
- Reach
- 42 repos · contents: write
Slack bot token
xoxb-…Checked with Slack
LiveRotate Now
- Workspace
- Acme
- Bot
- deploy-bot
500+ key types checked livePrivate keys: assumed validCan't check? We say whyStill on main, or only in history
AWS Secret · deploy/terraform.tfvars:14
- Looks like a secret
- Most tools stop here
- Live check with AWSAccepted
- Identityuser/ci-deploy
- Default branchNot visible
ROTATE NOWProvider accepted it
Other actions
RotateTriageNo ActionExpected
- WhenSecret Detected
- IfStatus is Rotate Now
- ThenJira issue to repo owner
- ThenSlack: rotate the key
Proven dead
A rotated key fails its re-check.
- Rotate NowLive key
- RotatedAt the provider
- No ActionRe-check rejects it
Owning team
Prevent
Keep secrets out of the code from the start.
In the agentAgent SkillsSecrets scan in the agentAt commitHeeler CLIPre-commit hookOn the workstationWorkstation SensorObserves agent sessionsOn the pull requestPR GuardrailsFlags for review
Automated end to end.Autotriage→Rotation workflow→Owner rotates→Re-checkAutonomous Operations →More in Operate
