// what it does
Find, validate, document — in one toolchain.
A match alone usually isn’t enough for a clean disclosure. keyhound is built around checking whether a key still answers, what it can read, and turning that into something a security team can act on.
Multi-surface find
GitHub code search with 90+ dorks, JS bundle + sourcemap walker, local filesystem scan, nested directory crawl. Anchored regex prefilter skips the 90% of files that can't possibly match.
Live validation
Every finding is tested against the real provider API with a read-only probe — whoami, list-models, get-account. Verdict is LIVE, DEAD, or ROTATED per key. No "potential match" noise to triage.
Ready-to-run checks
Per-provider templates (curl, Python, etc.) so you’re not rewriting the same probe every time. Chained steps can pass outputs between commands when you need a fuller picture of scope.
Disclosure drafting
Drafts an RFC-9116-aligned disclosure with CVSS, CWE, evidence block, fingerprint, and the matched security.txt contact already filled in. Five tones so you can pick what fits the vendor: humanized, formal, bug bounty, CVE-style, internal triage.
Recon on the side
Wraps the ProjectDiscovery / Tomnomnom stack: subfinder, httpx, katana, dnsx, urlfinder, waybackurls, gau, nuclei. Resolves attack surface before you even hit the regex layer.
Continuous monitor
An hourly GitHub Actions job in this repo can diff your watchlist against the last run (fingerprinted) and email only when something new shows up. You own the workflow and secrets — it’s not a hosted service.
// what it finds
Forty-plus providers, live-validated.
Not every pattern has a live validator — the ones below do. If your favourite isn't here, add a custom pattern + regex in the web UI.
// why keyhound
Where it spends extra effort.
| keyhound | gitleaks | trufflehog | Typical hosted scanner | |
|---|---|---|---|---|
| regex scan | ✓ | ✓ | ✓ | ✓ |
| live validation | ✓ 137 validators | — | partial | partial |
| multi-step command chains | ✓ 14 templates | — | — | varies |
| PoC templates | ✓ curl/py/js/pdf | — | — | — |
| disclosure draft | ✓ RFC-9116 + PGP | — | — | — |
| scheduled watchlist | ✓ GH Actions (self-hosted) | CI integrations | CI integrations | Hosted product |
| self-host | ✓ single binary | ✓ | ✓ | — |
| licensing | open source (self-host) | open source | open source / commercial | vendor pricing |
// get started
Get the tool.
Source is on GitHub. Reach out if you need help wiring validation keys or the watchlist workflow — especially for orgs scanning their own assets.
Build from source
Clone the repo and follow the README. Mail if you hit a blocker on your platform.
Watchlist help
Stuck wiring GitHub Actions, SMTP, or fingerprints? Email with what you’ve tried; I’ll point you at the right bits of the repo.
DIY cheatsheet
Don't want any of this? The free cheatsheet gives you pre-commit, trufflehog, rotation recipes, and an incident checklist. No signup.
Verify who we are
- /.well-known/security.txt — RFC-9116 contacts + expiry
- /assets/prowlr-pubkey.asc — PGP pubkey (ed25519 868D EAE7 70F8 42D9 87F3 6121 620C 1D20 99BE 336A)
- hackerone.com/anom5x — H1 handle with public disclosure history
- x.com/_NOT4H4CK3R — tag here if you're shouting out the disclosure
- prowlrbot.com — parent org