July 2026 — the entire x2y suite is now free. Code Leak Detector moves to a one-time $29 on 1 Sep.
View productsScan & Detect Exposed Secrets in Code
Desktop application that scans your entire codebase for accidentally exposed secrets — API keys, tokens, passwords, and other sensitive data. 200+ detection patterns with 100% offline processing.
After 1 Sep 2026: one-time $29 licence. No subscriptions, no recurring fees, no account required.
Key features
AWS access keys, GitHub tokens, Slack webhooks, Stripe secret keys, Google API credentials, private RSA/EC keys, JWT secrets, database connection strings, npm tokens, PyPI credentials and hundreds more — all matched locally against an offline rule pack.
Every scan runs entirely on your hardware. Source code, detected secrets, scan reports and rule packs never touch the network. There is no cloud analysis tier, no "send for deeper inspection" option, no telemetry pipeline. Verify with any network monitor.
Point the watcher at a working directory and receive instant notifications the moment a new secret is written to disk. Catch the leak at the keystroke — before it is staged, committed, or pushed to any remote.
Beyond pattern matching, the entropy analyser flags high-randomness strings that look like secrets even when they do not match a known pattern. Catch obfuscated keys, rotated tokens and novel credential formats that rule-based scanners miss.
Advanced capabilities
Run Gitleaks and TruffleHog rule sets alongside the native engine from a single interface. Combine detection strategies without leaving the application or managing separate toolchains. Results are merged, deduplicated and presented in a unified report.
Secrets hide in compiled binaries, compressed archives and embedded resources. Deep scan mode unpacks ZIP, 7Z, TAR, GZ and JAR files in memory, inspects binary strings and extracts credentials that surface-level scanners never reach.
Mark a finding as a false positive and the learning engine suppresses identical patterns in future scans — per project, per file, or globally. The allowlist is stored locally and never shared. Tune the scanner to your codebase without losing coverage.
Detected secrets are held in protected memory regions and masked in every output — the UI, the report, the clipboard. Full values are never written to log files, temporary directories or swap. When the scan ends, the memory is zeroed.
Specifications
| Product | Code Leak Detector |
|---|---|
| Version | v2.0.5 |
| Platform | Windows 10, Windows 11 |
| Detection patterns | 200+ (offline rule pack) |
| Detection methods | Pattern matching + entropy analysis |
| Integrations | Gitleaks, TruffleHog rule sets |
| Deep scan | Binaries, ZIP, 7Z, TAR, GZ, JAR |
| Real-time watch | File system watcher with instant alerts |
| Learning mode | Per-project, per-file, global allowlists |
| Reports | JSON, SARIF, CSV — CI-compatible |
| Pre-commit | Supported via CLI hook |
| Memory safety | Protected regions, zeroed on exit |
| Processing | 100% local — no cloud relay |
| Telemetry | 0 bytes — verified continuously |
| Account required | None — ever |
| Price | Free until 1 Sep 2026, then $29 one-time |
| Developer | x2y Devs Tools Ltd, Nairobi, Kenya |
Quick start
Download from itch.io. Run the installer — no administrator privileges required for standard installs. No account creation, no activation key. Free until 1 September 2026.
Select a working tree, a specific path, or an entire drive. Choose standard or deep scan mode. Enable Gitleaks or TruffleHog rule sets if desired. The rule pack loads from disk — no network fetch.
Findings appear in the dashboard with masked values, severity tags, file paths and line numbers. Use intelligent filtering to triage by risk level. Mark false positives to train the learning engine.
Export the report as JSON, SARIF or CSV for your CI pipeline. Rotate exposed credentials immediately. Use the pre-commit hook to prevent future leaks from reaching version history.
Downloads
Changelog
Expanded rule pack to 200+ detection patterns. Entropy-based secret detection for custom and obfuscated patterns. Gitleaks and TruffleHog rule set integration. Deep scan mode for binaries and compressed archives (ZIP, 7Z, TAR, GZ, JAR). Learning mode with per-project, per-file and global allowlists. Real-time file watcher with instant alerts. Secure memory handling with zeroed buffers on exit. SARIF and JSON report export for CI pipelines. Pre-commit hook support.
Report engine rewrite. Intelligent filtering by severity, file type and pattern category. Scan history with trend analysis across multiple runs. Masked value display in all outputs. CSV export added alongside JSON.
Initial release. Core pattern-matching engine with 80+ rules. Basic scan and report workflow. Manual scan only — no file watcher.
Security model
Code Leak Detector reads the files you tell it to scan — that is its function. It does not transmit source code, detected secrets, scan reports, file paths, or any other data anywhere. The rule pack is embedded in the installer and exists entirely on your filesystem. Detected secrets are masked in every output surface — the dashboard, the report, the clipboard — and held in protected memory regions that are zeroed when the scan completes. There is no cloud analysis tier, no "send for deeper inspection" option, no analytics SDK, no crash reporter. Verify with Wireshark, Fiddler, GlassWire or your firewall logs — you will observe zero outbound connections.
| Telemetry | 0 bytes collected |
|---|---|
| Account | None required — ever |
| Source access | Only directories you explicitly select |
| Detected secrets | Masked in all outputs, zeroed on exit |
| Rule packs | Bundled locally, never fetched |
| Cloud analysis | None — all scans local |
| Network | Zero outbound connections |
| Verification | Any network monitor |
Ready to scan
No account. No telemetry. No cloud. Just a fast, thorough scanner that catches exposed credentials at the keystroke — entirely on your machine.
| Version | v2.0.5 |
|---|---|
| Platform | Windows 10 / 11 |
| Price | Free until 1 Sep 2026 |
| Telemetry | 0 bytes |
