BetterLeaks is the same tool that was missing when an AWS admin token or payment gateway key was suddenly found in the code. Written in Go, it scans GitHub repositories, GitLab, S3 buckets, and other sources in minutes, catching secrets before they become a problem. 1.4 thousand stars on GitHub and 103 forks are not just numbers, but confirmation that security team leads and DevOps engineers have already adopted it: asynchronous validation over HTTP, filters on Expr for point tuning, Aho-Korasik algorithm for fast search – all this works in such a way that you can check hundreds of private repositories every day and automatically generate tickets to block detected keys.
What is BetterLeaks and how does it work
BetterLeaks is a next-generation secret scanner written in Go that helps find sensitive data in codebases and external repositories. The tool looks for tokens, API keys, passwords, and other sensitive strings accidentally found in repositories or artifacts. Runs fast thanks to optimized algorithms (in particular Aho-Korasik) and supports asynchronous validation of found secrets via HTTP requests — for example, checking whether an AWS key or a GitHub token is still valid.
Main features: search in GitHub, GitLab, S3 and other sources; flexible filters based on the Expr language (for example, exclude test data); mechanisms to reduce false positives, such as BPE tokenization. This makes BetterLeaks suitable for daily scanning of large codebases—for example, a company’s private repositories. Active secrets found can be automatically submitted for revocation by creating tickets in Jira or Slack, reducing the risk of data leakage.
The project is actively developing: on GitHub — 1.4k stars, 103 forks, regular updates. Ideal for security team leads and DevOps engineers who want to automate routine checks without losing accuracy.
Key features and benefits of the tool
BetterLeaks stands out because it doesn’t just search for secrets based on patterns, it does it intelligently. Expressive filters based on Expr allow you to configure scanning rules with surgeon precision. For example, you can exclude test keys or ignore tokens with certain prefixes — without having to write your own regulars or modify the code. This is especially valuable when dealing with large codebases where standard scanners generate hundreds of false positives.
To reduce noise, the tool uses several mechanisms at once. BPE-tokenization breaks potential secrets into pieces by analyzing their structure rather than simply comparing them to hard patterns. Aho-Korasik algorithm speeds up the search in large volumes of data, and pre-filters weed out obvious irrelevant cases even before deep verification. Result? Up to 70% fewer false positives compared to analogues – and this is not a theory, but real figures from practice.
Asynchronous validation via HTTP is another time-saving feature. BetterLeaks does not just find potential secrets, but immediately checks their relevance: it sends requests to API services (for example, GitHub or AWS) and confirms whether the token is really active. This is critical for large teams, where daily scanning of hundreds of repositories must be not only fast, but also efficient. There’s no point in spending hours analyzing false positives – the tool does it for you while you focus on strategic tasks.
Automation is the key to scaling. BetterLeaks can be integrated into CI/CD pipelines, scan an organization’s private repositories daily, and automatically generate revocation tickets for active secrets. For security team leads, this means that the risk of data leakage is reduced without manual intervention, and DevOps engineers get a tool ready to audit artifacts, from Docker images to configs in S3.
Who is BetterLeaks for and how to use it
BetterLeaks is a tool for those responsible for code security: cybersecurity team leads, DevOps engineers, and teams working with private repositories. If you face the risk of accidentally committing API keys, access tokens, or passwords on a daily basis, this scanner is for you. He not only finds secrets, but also helps to quickly neutralize them.
Typical usage scenarios:
- Automatic Repository Scanning – Run BetterLeaks daily or with every push to detect sensitive data in code, logs, or artifacts. Supports GitHub, GitLab, S3 and other repositories.
- CI/CD Integration – Add scanning as a step in the pipeline to block builds with detected secrets. For example, in GitHub Actions or GitLab CI.
- Automatic ticket generation – If the scanner finds an active token, it can generate a ticket in Jira or a Slack message for the security team requesting a revocation.
The tool works fast thanks to Go and the Aho-Korasik algorithm, and expressive filters based on Expr allow you to customize the search to the specifics of your code. With 1.4k stars on GitHub and active development, this is not an experiment, but a proven solution for real tasks.
BetterLeaks and its implications for security and SEO professionals
BetterLeaks is not just another secret scanner, but a tool that changes the approach to security in AI and SEO. Imagine: your team pushes dozens of commits to public repositories every day, and among them are access tokens to cloud services or API keys for analytics. BetterLeaks automatically scans codebases and external sources (GitHub, GitLab, S3) and detects sensitive data before attackers find it. For SEO specialists, this means protection against reputational risks: leaking Google Analytics keys or advertising accounts can lead to data manipulation or campaign blocking. And for AI engineers, this is a guarantee that the models will not be exposed to open access due to accidentally left API keys to cloud platforms.
The tool works quickly thanks to the Aho-Korasik algorithm and BPE tokenization, which reduces the number of false positives. Expressive filters based on Expr allow you to customize the scan to the specifics of your stack: for example, to search only AWS keys or Stripe tokens. Asynchronous validation via HTTP requests checks whether found secrets are still active and automatically creates revocation tickets. This is especially critical for large teams, where manually checking each commit is an unrealistic task.
With 1.4k stars on GitHub and 103 forks, BetterLeaks has already become the de facto standard for many security teams. The project is actively developing: updates are released regularly, new scanning sources are added, and filtering mechanisms are improved. For security team leads, this means the ability to integrate scanning into CI/CD pipelines and daily audits of the organization’s private repositories. And for SEO specialists, peace of mind: customer data and internal tools remain protected, even if someone on the team forgot to check the .env file before pushing.
Andrey Krasovskiy is a programmer and data scientist experienced in building complex automated systems with Python, Google Colab and n8n. His expertise spans SEO ecosystems, API integrations (Ahrefs, Google Ads, Search Console) and content pipelines. Andrey combines technical precision with an entrepreneurial mindset to build solutions that deliver real results.