KeyReaper – Automated Secrets-Leak Detection & Key Rotation

By Sai Vignesh, Jagan Mohan Reddy, Thejaswi Prasad

MARVEL Level 1 | UVCE

🔗 Links:

• GitHub Repository: https://github.com/saivignesh22/openday-secrets-detection

About the Project

KeyReaper is a CI/CD-integrated security pipeline that detects hardcoded credentials in Git commits and automatically revokes and replaces them by closing the loop from detection to remediation with no human intervention.

Most existing secret-scanning tools stop at detection: they find a leaked key and send an alert, leaving a human to log into a cloud console and manually revoke it. That gap is dangerous — attackers can exploit leaked credentials within minutes of exposure. KeyReaper removes that gap entirely, rotating the compromised credential automatically the moment it's detected, and surfacing the full incident timeline on a live dashboard.

Key Features

Automated Secret Detection Scans every commit's diff using regex signatures for known credential formats (AWS access keys, GitHub tokens, generic API keys) combined with Shannon entropy analysis to catch high-randomness secrets that don't match any known pattern.

Zero-Touch Rotation On a confirmed detection, automatically calls the AWS IAM API to delete the leaked key and issue a replacement — no manual console login, no waiting on a human responder.

Allowlist-Gated Safety Rotation only ever touches pre-approved sandbox credentials. Any key not on the allowlist is rejected outright, with zero cloud API calls made — a hard safety boundary against ever touching real infrastructure.

Live Incident Dashboard A real-time web dashboard showing every event — commit, file, secret type, detection time, rotation time, and status (detected / rotated / failed / rejected) — along with aggregate metrics like average detection-to-rotation time and success rate.

Full CI/CD Integration Runs entirely inside GitHub Actions: push → scan → allowlist check → rotate → dashboard update, completing within seconds of the commit landing.

Auditable Event Log Every action (successful or not) is permanently logged as structured JSON, giving a complete, timestamped audit trail of every incident the system has ever handled.

Technology Stack

• Detection Logic: Python, regex, Shannon entropy analysis
• Automation/CI: GitHub Actions
• Cloud Integration: AWS IAM via boto3
• Data Layer: JSON Lines (JSONL) event log
• Dashboard: HTML, JavaScript, Chart.js

How KeyReaper Differs from Existing Tools ?

Unlike tools such as GitGuardian, TruffleHog, or GitHub's native secret scanning which detect and alert but stop there — KeyReaper is:

• Remediation-Complete — Closes the loop with automatic rotation, not just detection
• Safety-Bounded — Hardcoded allowlist ensures rotation logic can never reach outside designated sandbox credentials
• Fully Observable — Every event, successful or failed, is visible on a live dashboard with full timing metrics
• Pipeline-Native — Built directly into CI/CD rather than as a separate scanning service, so remediation happens at the exact moment of exposure

While most competitors treat secret scanning as a monitoring problem, KeyReaper treats it as an incident-response automation problem — built end-to-end, not bolted on.

Project Journey & Evolution

The project was built in four coordinated phases across a 3-person team:

1. Foundation : AWS sandbox setup, IAM roles scoped to least privilege, repo structure, and a shared data contract agreed on before any code was written
2. Detection engine : Regex + entropy-based scanner, tested against 20+ positive and negative cases
3. Rotation + CI integration : GitHub Actions pipeline wiring detection to automated AWS IAM rotation, with an allowlist safety layer
4. Dashboard : Real-time incident visualization, later refined with auto-polling, cache-busting, and a derived live activity feed

Along the way, the team debugged and resolved several real integration issues — a masking mismatch between detection and rotation, a scanner feedback loop caused by re-scanning its own log file, and dashboard staleness caused by browser and local-clone caching — each fixed through direct root-cause debugging rather than workarounds.

Target Audience

• Development Teams — Wanting automated incident response for accidental credential leaks
• Security/DevSecOps Engineers — Looking to reduce mean-time-to-remediation for leaked secrets
• Educators & Students — Learning CI/CD security automation and cloud IAM integration hands-on
• Small Engineering Teams — Without dedicated security tooling budgets, needing a lightweight, self-hosted safety net

Future Scope

• Multi-provider support (GCP IAM, Azure Key Vault) beyond AWS
• Additional secret types: database credentials, third-party API tokens, Slack/Stripe keys
• Slack/email alerting alongside dashboard visibility
• Historical trend analysis (leak frequency by repo, team, or time period)
• Pluggable detection rules for org-specific credential formats