I built LLMHunter to hunt exposed LLM API keys

Author: Trix Cyrus [🔹 Try My] Waymap Pentesting Tool [🔹 Follow] TrixSec GitHub [🔹 Join] TrixSec Telegram [🔹 Tool Link] LLMHunter LLM applications are everywhere now, and so are API keys sitting inside frontend code, JavaScript bundles, source maps, and configuration files. So I built LLMHunter. LLMHunter is a Python CLI tool for discovering and validating potentially exposed LLM API keys across web applications and client-side assets. What can it find? It currently supports: Google Gemini OpenAI Anthropic Claude NVIDIA NIM The interesting part isn't just finding obvious strings like sk-.... LLMHunter also looks through: Inline and external JavaScript JSON manifests Webpack chunks JavaScript source maps Wayback Machine snapshots Obfuscated strings Split string concatenations Template literals Base64 and hex encoded strings Reversed payloads Once a candidate key is found, LLMHunter can validate it against the relevant provider and gather additional information depending on the provider. It can also check for things like referrer/origin restrictions and generate evidence that can be used during an authorized security assessment. A few usage examples Scan a target: llmhunter example.com Scan multiple targets: llmhunter -f targets.txt --concurrency 20 Validate keys directly: llmhunter --key-file keys.txt Filter by provider: llmhunter example.com --provider openai --provider anthropic Generate a JSON report: llmhunter example.com -o report.json --evidence I also added an offline testing sandbox with mock web targets and mock LLM providers, so the project can be tested without hitting real services. Why I built it A lot of credential hunting tools are really good at finding obvious patterns. But modern web applications don't always expose credentials as a clean: sk-xxxxxxxxxxxx Sometimes they're split across strings, hidden inside bundles, encoded, buried in source maps, or only present in older versions of a site. I wanted to experiment with building something that follows those trails instead of stopping at the first regex match. There's still a lot I want to improve, but this is a good starting point. GitHub: https://github.com/TrixSec/llmhunter LLMHunter is intended for authorized security testing, penetration testing, and defensive research. Don't scan targets you don't have permission to test. ~TrixSec