Note This repository has been superceded by the repositories within the https://github.com/pypi-data/ Github organisation. See https://py-code.org/ for more information.

This is a project to try to detect any AWS access keys that are accidentally uploaded to the Python Package Index (PyPi).

New uploads are scanned periodically, and if a valid key is detected then it is added to this repository under the keys directory. This will then notify AWS (via Github secret scanning) which will cause AWS to secure your key.

It can lead to anyone using these to perform potentially malicious actions on your account. See the AWS best practices document for more details.

This is a proof-of-concept that uses github actions to run a rust tool every hour. The main.rs file has a pretty good overview of the process and how it all works.

AWS will notify you via an email and apply the QuarantineV2 IAM policy onto the leaked key.