security
Secrets Detection on Every Push
Every file, every push — API keys and tokens your AI tool left in the code.
What you get
Every file, every push
The sweep runs across your whole codebase on every push, looking for credentials — API keys, tokens, connection strings — that an AI coding tool left behind.
The exposed line, named
When a secret is found, ZipLoom names the exact file and line so you can rotate and remove it before it reaches production.
Known key shapes and high-entropy strings
The sweep matches the formats real providers issue — Stripe, OpenAI, AWS, Supabase service keys — and flags high-entropy strings that look like credentials even when they fit no known pattern. Committed secrets remain the most common initial-access vector in cloud breaches.
How the sweep works
- 1
Every push triggers a scan of all files.
- 2
ZipLoom matches known secret patterns and high-entropy strings.
- 3
Any exposed credential is flagged with its file and line before deploy.
What this check inspects
Committed files and git history — a key that was removed in a later commit is still in the history and still compromised.
Client-side bundles, where a key added to the wrong environment variable ends up shipped to every visitor.
Known provider key formats — Stripe, OpenAI, AWS, Supabase service keys, GitHub tokens — matched on their actual published shapes.
High-entropy strings that look like credentials even when they match no known provider pattern.
What it means when this fails
An exposed key is not a theoretical risk: bots scrape public repositories and deployed bundles continuously and use found credentials within minutes. Committed credentials remain one of the most common ways cloud accounts are taken over, and a leaked service key usually bypasses every other control you have.
Questions
- A key leaked. Is rotating it enough?
- Rotate first, always. But assume the old key was used — check the provider's logs for activity you don't recognize, because the window between exposure and abuse is often measured in minutes.
- Why flag keys in git history if they're deleted now?
- Anyone who can clone the repository can read deleted content. Removal from the current files changes nothing about the key's exposure.
- Does it catch keys I put in the right place?
- Secrets stored in ZipLoom's encrypted vault are expected and aren't flagged. The sweep targets credentials sitting in code, config, or the client bundle.
What it replaces
GitHub Secret Protection
Secret scanning and push protection, per active committer. Free on public repos.
Snyk Team
Per contributing developer, 5-seat minimum (~$1,500/yr entry). Code + dependency scanning; does not deploy your app.
Semgrep Team
SAST with a strong free OSS engine; rules and triage are yours to maintain.
ZipLoom Solo — all 28 features included
Deploy, security scan, and monitoring in one flat price. Guild $40/mo · Studio $70/mo · Business $299/mo.
Related features