An alarm bell for leaked keys: KeyRotate now watches AI logs, repositories and web roots

Published 2026-10-24

October 2026 has been a hard month for anyone who looks after keys. An attacker reached the system where Railway stores its customers' environment variables and decrypted some of them, and an intruder in a legacy OpenCode Console system may have read the OpenAI, Anthropic and Google keys users had linked there. STUDIO said someone may have read the API keys its customers had saved in it. Onamae.com Desktop Cloud lost the trading logins stored on its servers. And attackers took over LiteLLM's release pipeline with GitHub tokens they found in logs that had recorded Claude Code's output, then shipped a release carrying malware that collected Claude, Codex, Gemini and Cursor sign-ins.

That last one is the pattern worth stopping on. Nobody pushed a token to a public repository. A coding agent ran a command, the command printed a token, and the transcript kept it. Everything in a transcript has already gone to the AI provider, and it sits on the Mac in plain text, in folders that credential-stealing malware knows to look in.

KeyRotate began as a tool for the moment after a leak: replace the key, update every file that used it, and keep the old one alive until nothing needs it. The version built on 24 October adds the part before that moment. It now watches the places where keys tend to end up, and rings when one of yours turns up there.

Guard: one screen for every warning

The new Guard screen gathers every sign that a key may be in someone else's hands, worst first. Each warning carries one action, such as Rotate now, Open key or Dismiss, so there is never any doubt about the next step. Its sensors are:

• AI tool logs, new in this version.
• Vendor breach advisories from Enfour's signed feed.
• Usage Watch, which notices a key being used in a way nothing on your Mac accounts for.
• The daily key check. Vendors revoke keys that are reported leaked, for example through GitHub's secret scanning, so a key the vendor suddenly refuses is a clue in itself.
• Leak Scan of your folders and their git history.
• Remote repositories, also new.

A badge in the sidebar counts the warnings, and a box on the Overview shows the alarms the other boxes don't.

AI tool logs

KeyRotate reads the conversation logs of Claude Code, Codex, Gemini CLI, Qwen Code, OpenCode, Goose, Cline and Roo Code, and any other folder of AI logs you add, such as an AI proxy's request log. It checks them every hour, and after the first pass it reads only the new lines.

Your stored keys are matched by exact value, including the JSON-escaped form a password takes inside a transcript. Anything else that looks like a secret is found with Gitleaks' rules. When a stored key still holds the value that was found, that is an alarm, and it repeats every day until the key is rotated. If you have set up ntfy or Gotify, it reaches your phone as well.

We tried it on our own machine first. Claude Code's logs held Anthropic, OpenAI, AWS and Stripe keys, and private keys too. If you use a coding agent every day, it is worth assuming yours hold some as well.

Repositories, every branch and tag

Add an account on GitHub, Gitea or Forgejo (Codeberg and self-hosted servers included), GitLab or Bitbucket and pick the repositories to watch, or give the address of any HTTPS git server. KeyRotate copies each repository's full history, every branch and tag, into its own storage on your Mac. It speaks git's protocol itself, so there is no git to install, which matters for a sandboxed App Store app. Leak Scan then searches the copy, and after the first copy KeyRotate fetches only the changes, once a day.

On GitHub it also reads GitHub's secret-scanning alerts and tells you when a secret GitHub found still works. The tokens it uses to reach your accounts are keys like any other, kept in KeyRotate's vault.

One of your keys in a repository's history is an alarm. In a private repository, everyone who can clone it can read the key. In a public one, anyone can.

Web projects, and the .env files a rotation would miss

A Leak Scan folder can now be a web project. Add web project… offers shortcuts to ~/Sites, /Library/WebServer/Documents, MAMP's htdocs and Herd, and Pancake Stack and FrontierStack have a new Watch in KeyRotate… button on each site or virtual host. Findings in a web project are judged by how the web server treats the file:

• In the web root and not executed (.env, .json, .sql, backups, logs): anyone can download it.
• Scripts and pages: sent to every visitor's browser.
• PHP and other server code: hard-coded. It isn't public, but it travels with every copy, backup and repository.

Web projects are re-scanned daily, and any other folder can be too with Re-scan daily.

Every folder scan also lists the .env files that aren't KeyRotate targets: the copies a rotation would otherwise miss. Import keys and make targets… imports their keys and makes each file a target, so the next rotation rewrites it. Update old keys… writes the current key over an older copy, changing only that line and keeping a backup.

Breach advisories between releases

Enfour publishes signed advisories between app releases, and KeyRotate accepts only those signed with the key built into the app. Advisory #4, published on 24 October, covers LiteLLM 1.107.0, GitLab CVE-2026-110264, the Node.js October security release, Onamae.com Desktop Cloud, FXTF, Gaitame Finest, ThreeTrader, SBI Securities' warning about passkey hijacking, the State Bank of India data leak and DigiD's precautionary PHP shutdown. Each appears as a card on the Overview with a checklist, and asks which of your keys you saved with that service. We wrote about two of them in more detail: the Onamae.com Desktop Cloud breach and the STUDIO breach.

How it stays on your Mac

• Nothing leaves your Mac except requests to the vendors and git hosts you chose, and notifications to your own ntfy or Gotify server if you set one up. Fetching advisories is a download.
• No secrets in the results. A finding records where and when, with a masked preview. The secret itself is never stored.
• Logs are read where they are. KeyRotate doesn't copy your AI transcripts or send them anywhere. Repository copies live in KeyRotate's own storage on your Mac.

Honest limits

• It guards only while it runs. Closing the window keeps KeyRotate in the menu bar, checking every 15 minutes and on wake. Quit stops the checks. Guard offers Open at login so it starts with your Mac.
• Rotating doesn't clean history. A key in a repository's history or an AI transcript stays there after you rotate. What makes it harmless is revoking the old key at the vendor, once nothing still uses it.
• The AI provider already has it. A key that appeared in a transcript went to the provider when it was written. Finding it on your Mac tells you to rotate; it can't take it back.
• It sees only what you add. Folders, logs and repositories you haven't added aren't scanned. A key that was copied elsewhere before you started shows up only through how it is used: Usage Watch, for the vendors it covers, and the vendor's own refusal.

Getting started

1. Update KeyRotate from the Mac App Store and open Guard.
2. Let the first pass over your AI tool logs finish. Later passes read only new lines. Add any other folder of AI logs you keep.
3. Under Remote repositories, add your accounts, with their tokens saved in KeyRotate's vault, and pick the repositories to watch.
4. Add your web projects, or press Watch in KeyRotate… on a site in Pancake Stack or FrontierStack.
5. Deal with the .env files the scan lists, then turn on Open at login.

Then, for every key Guard rings about: rotate it, and once nothing still uses the old one, revoke it. See what KeyRotate does.