Show HN: LeakLock – Gitleaks for your live site(finds keys with no known format)

LeakLock's release as an open‑source “Gitleaks for your live site” tool that scans rendered pages for secret API keys—even those without a known format—brings a new level of automated credential discovery to the browser surface. For website owners, this means that any hard‑coded secrets inadvertently shipped to the client side can now be harvested by bots running LeakLock or similar scanners at scale. The tool’s pattern‑agnostic detection expands the attack surface beyond traditional regex‑based leaks, exposing keys embedded in JavaScript bundles, inline scripts, or even dynamically generated HTML. Sites that previously considered themselves safe because they used non‑standard key formats may suddenly see a spike in automated scans and potential abuse of exposed services. **Actionable steps:** 1. Add a `User‑Agent: LeakLock` rule to your `llms.txt` to identify and log these scans, then monitor request frequency for anomalies. 2. Deploy a build‑time check (e.g., integrate LeakLock into CI/CD) to block any secret leakage before deployment, complementing existing Gitleaks scans. 3. Implement a Content Security Policy that restricts inline scripts and enforces script hashing, reducing the chance that undisclosed keys are ever sent to the browser.