key_exposure
Scans directories for readable private keys, encrypted keystores, and retained copies of rotated secrets, without decrypting or outputting key material.
Instructions
What key material is on this disk, and which of it is readable without a password? The companion to seed_exposure, and it exists because a real theft happened WITHOUT the phrase ever being written down: the key was exfiltrated. The trap is that a secp256k1 private key is 64 hex characters and so is every SHA-256 hash, every git object id and every transaction hash in a saved response — searching for the value SHAPE finds hashes by the thousand. Two things carry information instead: STRUCTURE (a Web3 Secret Storage keystore has version 3 and a crypto member with ciphertext, kdf and mac — nothing else looks like that, and finding one is not an exposure, it is an encrypted wallet whose strength is its password), and THE LABEL (cleartext keys are named by what needs them, so this matches PRIVATE_KEY and rejects PRIVATE_KEY_HASH). The finding people miss is RETAINED COPIES: rotating a secret does not remove it from the disk, because editor history, session caches and backup folders keep snapshots of what the file used to say — on the machine this was built for, one .env with three named keys had eighteen previous versions still readable. Also reports browser wallet vaults by PRESENCE only, since that is how a key leaves a machine when it was never in a text file. Never outputs key material, not even a prefix: a four-byte prefix narrows a brute force. Read-only, never decrypts, never derives an address.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| paths | No | directories to scan; defaults to Documents, Desktop and Downloads |