Leak detection

Security signals

Each key learns where it is normally used from. After it has learned, Vallkey raises a signal when the key is used from a new country or a new network, when traffic jumps to 10 times the usual hour, or when many requests are blocked at once. Signals appear on the overview and on the key's page, and new countries also send an alert. Turn on Automatic kill to act on them without waiting for you.

Keys pushed to GitHub

Ghost keys and API tokens have a fixed, recognizable format. When one is pushed to a public GitHub repository, GitHub tells Vallkey and we turn it off at once: a ghost key is killed, an old ghost key from a rotation stops working, and an API token is revoked. You get an alert with the link to where it was found, and the audit log shows "GitHub secret scanning".