Guide · Secrets
Scan your exports for API keys & secrets
The most common way secrets leak is not a breach — it is anyone who ever pasted a key into a chat and hoped. This guide finds every one of those keys, locally.
Why this matters
Developers paste sk-…, ghp_… tokens, Stripe keys and passwords into ChatGPT and Claude to debug, summarize and share context — then forget they ever did. Months later an export is shared, a device is re-used, or a model is scraped. The exposure already happened; the only remaining question is whether you ever find out.
This scanner is fully local — same principles as the analyzer itself. The detection runs in a background Web Worker on your CPU, so even a multi-gigabyte export scans without uploading a byte or freezing the UI.
1. Load your export
Follow the ChatGPT or Claude guide, then drag that export into AI Data Inspector. Drop the ZIP, the folder, or the raw JSON files — the tool auto-detects the format.
2. Run the secret scan
Open the scanner after parsing completes. The analyzer sweeps message text in every role — user, assistant, system — and flags hits by category and severity:
- OpenAI-style API keys (sk-…)
- GitHub & GitLab personal tokens
- AWS / Azure / GCP key patterns
- Stripe & payment provider keys
- Generic bearer tokens & passwords
- Private keys and JWT material
3. Triage the report
Matches are grouped by severity and linked back to the conversation and message that contained them. Work high-to-low:
- Rotate real credentials. For any confirmed key, generate a new one in the provider's dashboard and revoke the exposed value. Do not leave a confirmed key in place.
- Dismiss false positives. Pattern matches like sk- in prose, example values, and redacted placeholders are common. Marking them ignored keeps future reports honest.
- Plan to redistribute. For exports you share afterward, prefer JSON scrubbed of the matched strings.
4. Export a clean copy
When you're done reviewing, use the analyzer's export (Markdown, clean text, or JSON) to keep an audit-proof, mobile-friendly copy. All exports are generated locally and downloaded as files — the exact records you scanned never leave your machine.
Questions
What kinds of secrets does the scanner find?
The scanner flags likely API keys, bearer tokens, passwords and private keys — the patterns that show up when you paste credentials into a chat. It groups hits by severity so you fix the dangerous ones first.
Does the scan leave my machine?
No. Scanning runs in a Web Worker on your device. The scanner has no network access and no results are transmitted anywhere.
Is every match a real secret?
No. The scanner is pattern-based and deliberately over-broad to avoid missing a real credential. Review matches in the report and dismiss false positives before revoking anything.
What should I do with a real match?
Treat it as exposed: rotate the credential at the provider immediately (OpenAI, GitHub, Stripe, etc.), then decide whether to purge it from the export you keep.