Leaks & Secrets

API keys, authentication tokens, database credentials, infrastructure secrets and service keys left in a public Git repo, an open cloud bucket, a .env file or an accessible config, or spat out by an overly talkative endpoint. In short: anything that looks like an exploitable credential sitting on an asset tied to your domain. Detection is automated and follows what an attacker looks for first; it does not replace the human verification of a pentest, which is a separate offering.

We start from your root domain and pull up your surface (subdomains, IPs, services, cloud storage) without you having to provide access. Public repos and code leaks tied to your perimeter are then combed for secrets sitting in the code, the commit history and files versioned by mistake. The scope stays under your control: we unroll from the domains you declare, no reckless attribution to repos that aren't yours.

Yes. Public S3 buckets, Azure Blob Storage, open GCP Storage, exposed storage instances. Dedicated modules check storage ACLs and flag endpoints vulnerable to SSRF, which can be used to reach cloud metadata. If a bucket is reachable from the Internet and tied to your domain, it surfaces in the inventory along with what it lets leak: public files, secrets, configs.

No. The secret's value is masked before it is written to the database, by default. The platform keeps the fact that a key leaked, its type and its location, not the exploitable secret itself. You have enough to act (revoke, rotate the key, close the bucket) and enough to hand to an auditor, without a dump of our database replaying the leak. Detecting a secret without re-trapping it by copying it is the baseline behaviour, not an option.

Those tools scan a repo you point them at, often your own, internally. They only see what you give them. Here, we answer the question before that: what leaked on your external surface, where you aren't looking? We start from a single domain, discover the public repos, buckets and exposed files nobody inventoried, and continuously monitor what appears. The two are complementary: the internal scanner goes deep on the known repo, EASM finds the exposed leak you didn't know about.

On a High or Critical finding from a verified domain, you can ask an autonomous AI agent to try to confirm the secret is actually exploitable, within strict guardrails (20 steps, 300 seconds, 150,000 tokens per finding) and an ephemeral sandbox with filtered network egress. If it proves it, the finding moves to confirmed with a stored proof, secrets masked. It is AI, not a human pentester, and it is quota-limited: 2 validations a month on Discovery, 30 on Pro, 100 on Business, unlimited on Enterprise. We don't promise zero false positives; thorough human verification is our pentests, a separate offering.

You schedule periodic scans (cron) and trigger on-demand ones from the interface or the API. On every pass, you get the delta: new secret that appeared, bucket flipped to public, config file newly accessible, finding resolved. Volumes depend on the plan: 10 scans a month on Discovery, 100 on Pro, unlimited on Business and Enterprise. You track your usage in real time.

Article 21 of NIS2 mandates risk management that includes asset mapping and continuous monitoring of the exposed surface, secrets and shadow IT included. Leak detection contributes directly: a live inventory of the secrets and assets that leak, an alert on the first change, PDF and CSV reports exportable for your auditors. To be clear: it doesn't cover all of NIS2 on its own (governance, incident response, supply chain remain on you). It addresses the knowing and controlling what you expose part.

No minimum term. The subscription is monthly or annual (annual works out at ten months paid), renewed tacitly at each due date, and you cancel it at any time, with no justification to give: either you do it yourself from your billing area, or you write to contact@own2pwn.fr and the answer comes within 24 hours. No notice period to serve: cancellation takes effect at the end of the current billing period, and you keep access until then. In return, that period is not refunded pro rata. That is not a sales promise, it is article 7 of the terms of sale.

No. The Discovery plan opens from the sign-up form, with no payment method: no card to enter, no counter starting after fourteen days. It is not a trial but a free plan with no time limit and its own quotas (1 domain, 25 tracked assets, 10 scans per month). The Leaks & Secrets module is included in it, not sold separately. A card only comes into play if you move to a paid plan, and payment happens on own2pwn.fr, by card only.

Access opens immediately after the payment is validated. In practice: as soon as the payment is confirmed, the subscription is attached to your account and the plan quotas apply, with no manual step in between. If you subscribe without an own2pwn account yet, the payment creates one and you get an email to set your password: access is live as soon as that is done. If anything gets stuck, write to contact@own2pwn.fr, the answer comes within 24 hours.

Yes, and without starting over: the account, the domains you declared and the scan history stay in place, only the quotas change. Modules are never billed separately: Leaks & Secrets comes with the EASM subscription, so changing plan moves the quotas of every module at once. You request the change by email to contact@own2pwn.fr, stating the plan you want and the date it should take effect; the answer comes within 24 hours. What is settled on the billing side is that the period already paid for is not refunded pro rata (article 7 of the terms of sale); the exact amount and the effective date of the new plan are confirmed to you in writing before anything is validated.

Some error pages, verbose API responses or overly talkative headers spit out tokens, internal paths or credentials. The scan flags these endpoints that disclose more than they should, exactly where an attacker looks for a free foothold.

Where your team already works, the same day: Slack, Teams, Jira, GitHub, GitLab, PagerDuty, or an HMAC-signed webhook if you wire your own tooling. The signature lets you check the notification really comes from us before acting on it automatically. A leaked secret gets traded fast, so the point is knowing before somebody else uses it, not at the next report.