How to Audit Logs for Leaked API Keys and GitHub Tokens

This guide walks you through auditing your application and GitHub logs to find accidentally exposed API keys and tokens. You’ll learn how to search logs for known secret patterns, filter out false positives, and verify whether a leaked key is still active. This process helps you catch credentials before attackers do, and it’s a core part of any security review.

What You’ll Need

• Access to your log storage (e.g., AWS CloudWatch, ELK stack, Papertrail, or plain text log files).
• A list of your known API key prefixes (e.g., GitHub tokens start with ghp_, Stripe with sk_live_).
• Basic command-line knowledge (grep, jq) or a log search UI.
• Optional: A script to test if a key is still valid (e.g., using the service’s API).

Step-by-Step

1. Define your search scope. Decide which log sources to audit: application logs, build logs (CI/CD), error tracking, and any third-party service that might echo request headers. For GitHub specifically, also check audit logs and webhook delivery logs.
2. Identify secret patterns. Create a list of regex patterns for the tokens you want to find. Common ones: GitHub (ghp_[A-Za-z0-9]{36}), AWS Access Key (AKIA[0-9A-Z]{16}), Stripe (sk_live_[0-9a-zA-Z]{24}), Slack (xox[baprs]-[0-9A-Za-z-]{10,}). If you have custom keys, use their prefix.
3. Search your logs. Use your log search tool to run a query for each pattern. For text files, use grep: grep -rE "ghp_[A-Za-z0-9]{36}" /var/log/. For structured logs, use jq to filter fields like message or request.headers.
4. Review matches for false positives. Not every match is a real leak. A token in a log line might be a placeholder like ghp_xxxxxxxx or a sample from documentation. Look for context: is it in a header, a URL, or a body? Does it appear alongside a real request?
5. Extract the candidate tokens. For each potential leak, copy the token and the surrounding log entry. Record the timestamp, service, and how it got logged (e.g., error message, debug output).
6. Verify if the token is still active. Use the service’s API to check. For GitHub: curl -H "Authorization: token YOUR_TOKEN" https://api.github.com/user. A 200 response means it’s valid; 401 means revoked. For AWS, call sts get-caller-identity. Do this carefully—if the token is live, it will be flagged as a security incident.
7. Revoke and rotate. Immediately revoke any confirmed active token. For GitHub, go to Settings → Developer settings → Personal access tokens and delete it. For AWS, deactivate the access key in IAM. Then issue a new one and update your applications.
8. Fix the root cause. Determine why the token appeared in logs. Common causes: logging request headers, including auth in URLs, or printing environment variables. Update your logging configuration to redact sensitive fields (e.g., use log redaction or masking).
9. Document and monitor. Add a note to your incident log. Set up alerts for any future occurrences of the same pattern in logs.

Common Mistakes

• Ignoring build logs. CI/CD logs often contain secrets because they echo environment variables. Always include them in your audit.
• Searching only for full tokens. Some logs truncate tokens. Search for the prefix alone (e.g., ghp_) to catch partial leaks.
• Not checking for encoded secrets. Tokens might be URL-encoded or base64-encoded. Decode first if you suspect this.
• Assuming all matches are real. Test each one. Revoking a token that’s already invalid is harmless, but revoking a placeholder could break a test environment.
• Forgetting about historical logs. Secrets can linger for months. Search back as far as your retention allows.

Tips

• Use a tool like gitleaks or trufflehog to scan git history and logs automatically. They have built-in regexes for many providers.
• If you use a log management service, create a saved search or alert for each secret pattern.
• Regularly rotate your keys even if no leak is found. This reduces the window of exposure.
• When testing a token, use a dummy request—don’t make a real API call that could trigger side effects.
• Encourage developers to use environment variables and secret managers instead of hardcoding keys.

Troubleshooting

• No matches found. Double-check your regex. Test it on a sample token. Also, consider that logs might be encrypted or compressed—unpack them first.
• Too many false positives. Refine your regex to require the exact length and character set. For GitHub, ghp_[A-Za-z0-9]{36} is specific. If you’re still overwhelmed, filter by log source or time range.
• Token is valid but not in logs. Maybe the leak is in a different source, like a public GitHub repo or a paste site. Use GitHub’s secret scanning alert if you have it enabled.
• Cannot test the token. Some services don’t have a simple API to validate keys. In that case, treat it as a leak and revoke it anyway.
• Logs are too large to search. Use a more targeted approach: search only logs from the last 30 days, or filter by service that handles auth.

Frequently Asked Questions

Can I automate this audit?

Yes. Tools like gitleaks can scan git history, and you can write cron jobs that run regex searches on new log entries. Many log services allow you to create alerts that trigger when a pattern appears.

What if I find a token that is already expired?

No action is needed beyond noting it. Expired tokens are useless, but the leak still indicates a logging issue that should be fixed.

How often should I audit?

At least monthly, or after any major code change. If you handle sensitive data, consider weekly automated scans.

Can a leaked key be used even if it’s in a log?

Yes, if the log is accessible to someone with malicious intent. That’s why it’s critical to act quickly.

What about tokens in error messages?

Error messages are a common leak vector. They often include request details. Make sure your error reporting tool redacts headers and query parameters.

Should I revoke a token even if it’s a false positive?

If you’re unsure, it’s safer to revoke and rotate. The cost is low compared to a potential breach.

Related

• DPI vs 1200 DPI: What’s the Real Difference?
• Best Wii U Games: Top Picks & Buying Guide
• Cambrian Explosion: Animals Before It?