claudleak

Scans public GitHub repositories for leaked credentials in AI coding tool configuration files (.claude/, .cursor/, .continue/, .codex/, CLAUDE.md, AGENTS.md, etc.).

Uses TruffleHog for secret detection.

Example .claude/ directory:

{
  "permissions": {
    "allow": [
      "Bash(go build:*)",
      "Bash(RAPID7_ENCRYPTED_CREDS='**eP3g488hQ23QiU4kJahhwPKs3PyE**' go test ./pkg/agents/ -run TestRules -v -count=1 -timeout 30s)",
      "Bash(gcloud sql instances list:*)",
    ]
  }
}

Install

go install github.com/niels/claudleak/cmd/claudleak@latest

Or build from source:

git clone https://github.com/niels/claudleak.git
cd claudleak
go build -o claudleak ./cmd/claudleak/

Usage

GITHUB_TOKEN="ghp_..." ./claudleak

Flags

Flag	Default	Description
--token	$GITHUB_TOKEN	GitHub personal access token
--max-repos	100	Maximum repositories to scan
--workers	CPU count	Concurrent clone/scan workers
--json	false	Output results as JSON
--output	stdout	Write results to file
--verified-only	false	Only show verified credentials
--org / --user		Only scan repos owned by this GitHub user or org
--verbose	false	Show progress/debug info

Examples

# Scan up to 50 repos, output JSON to file
claudleak --max-repos 50 --json --output results.json

# Verbose scan with 4 workers
claudleak --workers 4 --verbose

# Scan a specific org, only verified secrets
claudleak --org microsoft --verified-only

How It Works

1. Discovery — Searches GitHub Code Search for repositories containing AI coding tool config files
2. Clone — Clones matching repositories to a temp directory
3. Scan — Runs TruffleHog against each clone, filtering findings to AI config paths
4. Report — Outputs a table (or JSON) of detected secrets

Project Structure

cmd/claudleak/main.go    CLI entrypoint
pkg/config/              Config parsing
pkg/discovery/           GitHub repo discovery
pkg/cloner/              Git clone operations
pkg/scanner/             TruffleHog secret scanning
pkg/reporter/            Table/JSON output

Exit Codes

• 0 — No secrets found
• 1 — Secrets found (or runtime error)
• 2 — Configuration error