Leakhound for Mac

Leakhound is a menu bar app that scans your Mac for secrets that should not be lying around unprotected, and keeps watching new and changed files after the first scan.

What it finds

• Plaintext passwords in files, password lists, and shell history.
• API keys and tokens, .env files, AWS, Git, npm, Docker, PyPI, GitHub CLI, Kubernetes and PostgreSQL credentials.
• SSH private keys without a passphrase, wrong permissions, or stored outside ~/.ssh
• Malicious script patterns: curl-to-shell, obfuscated or eval'd remote code, reverse shells, Gatekeeper bypasses, fake password dialogs, Keychain access.
• Autostart items from suspicious folders, unsigned programs, or shell one-liners.
• AI traces: secrets saved in assistant conversations, sensitive files read or risky commands run by AI agents, API keys in AI configs, over-permissioned agents, possible prompt injection.
• Network exposure: services listening without authentication, unsigned programs with internet connections, active proxies, /etc/hosts redirects, installed configuration profiles.

How it works

• You choose which folders (Desktop, Documents, Downloads, iCloud Drive, or Full Disk Access) and which categories to check.
• Every finding explains the risk and what to do about it; some can be fixed with one click (for example file permissions).
• Live monitoring of new and changed files with optional notifications for critical and high findings.
• Dashboard can be locked with Touch ID or your password.
• Widget for an at-a-glance status.
• Available in 33 languages.

Privacy

• All analysis runs on your Mac. Nothing is uploaded, and secrets are only shown masked.