RepoGuard – API key leak and abuse sentinel

Scan repos for hardcoded AI API keys and monitor for abnormal usage charges.

Problem

A developer on V2EX uploaded a personal project to Gitee with a hardcoded API key, which was stolen and ran up daily charges on Pro model calls. Separately, someone found Xiaomi's MiMo CLI silently uploading repo URLs, commits, and machine info to a tracking server. Developers need more proactive leak and abuse monitoring.

Solution

A lightweight tool that regularly scans local and remote Git repos for hardcoded AI API keys (DeepSeek, Claude, OpenAI, etc.) and alerts immediately. It can also connect to cloud billing APIs, push alerts when a key's usage spikes, and rotate keys with one click.

Users

Indie developers, small SaaS teams, and maintainers of personal projects using third-party AI APIs.

MVP

Scan local Git repos and public/private repos on common hosts (Gitee, GitHub); detect key formats from major AI providers; alert on hardcoded finds; provide a simple daily usage dashboard by connecting to billing APIs or logs.

Revenue

Free tier monitors one repo; paid tier supports multiple repos, billing integration, and automatic key rotation via subscription.

Why now

AI API usage is exploding, but key management is still primitive. Indie developers lack a security team, and a single leak can cause ongoing charges.