Detection reference · Credentials and secrets · Updated 2026-11-03

Private keys in PEM format

A private key is the most damaging thing to paste anywhere: it signs, decrypts and logs in as you. PEM keys announce themselves with a header line, and Redaxa replaces the whole block.

At a glance

Reported as	Private key
Category	Credentials and secrets
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[PRIVATE KEY]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 227

What it looks like

A -----BEGIN … PRIVATE KEY----- line, the key body, and the matching -----END … PRIVATE KEY----- line. The key type in both lines must match.

Example

You paste

-----BEGIN OPENSSH PRIVATE KEY-----
RedaxaDocsSampleNotARealKeyBodyRedaxaDocsSampleNotARealKeyBodyRedaxaDo
-----END OPENSSH PRIVATE KEY-----

Redaxa returns

[PRIVATE KEY]

Reported as	Private key
Severity	critical: direct account or system compromise, as with keys, passwords and tokens
Replaced with	`[PRIVATE KEY]`
Probable service	Unknown service
Credential type	Private signing key
Evidence	The value alone does not identify its owner or issuing service.
Recommended action	Identify owner, then rotate if genuine

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

deploy/id_ed25519: Private key, listed for review (severity critical). Credential pattern matched. Validity is not tested; review and rotate if genuine.
Same value in tests/fixtures/id_ed25519: Test or example value, counted but not listed. Real-looking keys in test files are still reported.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

-----BEGIN PUBLIC KEY----- RedaxaDocsSampleNotRealRedaxaDocsSampleN -----END PUBLIC KEY-----: not flagged. Public keys are meant to be shared.
-----BEGIN RSA PRIVATE KEY----- RedaxaDocsSampleNotRealRedaxaDocsSampleN: not flagged. A BEGIN line without its END line is not replaced; the block is incomplete.

If it already leaked

Treat the key pair as compromised: generate a new pair, install the new public key where the old one was trusted (servers, Git hosts, certificate authorities) and remove the old one. Revoke any certificate issued for it.

What Redaxa adds to every finding of this kind: If genuine, revoke or rotate it at the issuing service, update the application, then remove the exposed value from code and review Git history. Deleting it from Git does not revoke access.

Step by step: pasted a key into ChatGPT, or committed one to GitHub.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Worried it is already in your code? Check a public GitHub repository free (3 checks a day).

Sources

Redaxa engine: scanner.ts line 227, credential-context.ts line 28 (Unknown service). Every output on this page was produced by that code when the page was built.
RFC 7468: Textual encodings of PKIX, PKCS and CMS structures