KeySieve

One-time $14.99 for the app with Pro: git history, any number of repositories, the pre-commit hook and reports. No subscription. One license key works on up to 3 of your Macs.

Download: The download (a signed, notarized .dmg) comes with your purchase in your Gumroad receipt, together with your license key. Updates install from inside the app.

Buy now opens Gumroad's checkout on this page; Gumroad is the seller and handles payment, sales tax and your receipt.

Features

• Finds API keys, tokens, passwords and private keys with gitleaks’ 222 rules (MIT License), applied by KeySieve’s own scanner
• Every finding masked (first 4 characters only), in the window, the reports and the hook
• Fix steps in order: rotate the key first, take it out of the code, then optionally clean history with git filter-repo
• Git history: every commit on every branch
• An ignore list in .gitleaksignore, shown before it’s written; gitleaks reads the same file
• An opt-in pre-commit hook that never replaces a hook it didn’t write
• PDF and CSV reports with masked values only
• It reduces risk; it can’t guarantee every secret is found

Requirements

macOS 14 Sonoma or later. Apple silicon and Intel. Needs git (Apple’s command line developer tools or Homebrew). Current version: 1.0.

Privacy

Everything runs on your Mac: nothing is uploaded, findings are kept in memory only, values are masked everywhere, and no key is ever tested online. The only network requests are the license check with Gumroad and checking for updates.