nullcipher

Mailgun API keys (key-…) and webhook signing keys

After a name containing “mailgun”: key- plus 32 hex digits (private API key), pubkey- plus 32 hex digits (public validation key), or a 32-8-8 hex signing key. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Mailgun API key

What an AI chat would receive after masking

# EXAMPLE, not a real key
MAILGUN_API_KEY=[MAILGUN_PRIVATE_API_TOKEN_1]

1 × Mailgun API key found and masked.

How nullcipher recognises it

Checked only when the text contains “mailgun” (any case). Pattern (gitleaks rule mailgun-private-api-token, v8.30.1, translated to JavaScript): /[\w\-.]{0,50}?(?:[Mm][Aa][Ii][Ll][Gg][Uu][Nn])(?:[\w\t \-.]{0,20})[\s"']{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\s"'=`]{0,5}([Kk][Ee][Yy]-[0-9A-Fa-f]{32})(?:[\s"';`]|\\[NRnr]|$)/ — the first capture group is masked; any surrounding key name stays readable.

This is the rule text of the “Mailgun private API token” detector in the masking engine, copied from the engine when this page was built; the rule is ported from gitleaks’ default rule set (MIT licence; version, skipped rules and changes). Detectors run in a fixed order and, where two overlap, the earlier one wins.

The same page covers 2 more rules, each with its own placeholder:

Mailgun signing key — [MAILGUN_SIGNING_KEY_1]
Checked only when the text contains “mailgun” (any case). Pattern (gitleaks rule mailgun-signing-key, v8.30.1, translated to JavaScript): /[\w\-.]{0,50}?(?:[Mm][Aa][Ii][Ll][Gg][Uu][Nn])(?:[\w\t \-.]{0,20})[\s"']{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\s"'=`]{0,5}([0-9A-Ha-h]{32}-[0-9A-Ha-h]{8}-[0-9A-Ha-h]{8})(?:[\s"';`]|\\[NRnr]|$)/ — the first capture group is masked; any surrounding key name stays readable. (gitleaks rule)
Mailgun public validation key — [MAILGUN_PUB_KEY_1]
Checked only when the text contains “mailgun” (any case). Pattern (gitleaks rule mailgun-pub-key, v8.30.1, translated to JavaScript): /[\w\-.]{0,50}?(?:[Mm][Aa][Ii][Ll][Gg][Uu][Nn])(?:[\w\t \-.]{0,20})[\s"']{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\s"'=`]{0,5}([Pp][Uu][Bb][Kk][Ee][Yy]-[0-9A-Fa-f]{32})(?:[\s"';`]|\\[NRnr]|$)/ — the first capture group is masked; any surrounding key name stays readable. (gitleaks rule)

Example (fake)

# EXAMPLE, not a real key
MAILGUN_API_KEY=key-0123456789abcdef0123456789abcdef

nullcipher replaces it with [MAILGUN_PRIVATE_API_TOKEN_1]. The 32 hex digits after key- are 0-f twice. Mailgun never issued it.

Why it matters in an AI chat

A Mailgun private API key can send mail from your domains and read logs of what you sent and to whom. Mailgun's own guidance lists unexpected spikes in API calls and calls from unfamiliar IP addresses as signs of a compromised key.

These are gitleaks' rules, and they need the word mailgun just before the value (MAILGUN_API_KEY=, mailgun_key:). A key pasted with no mailgun-named setting in front of it is not masked, and Mailgun keys created with role-based access do not all carry the key- prefix; the 32-8-8 signing-key pattern and nullcipher's password-in-config rule (for names ending in key or secret) catch some of those.

Mailgun keys sit in framework mail settings and are pasted into AI chats when mail stops sending.

If it already leaked

  1. Mailgun's steps for a suspected compromise: immediately revoke the compromised key in the Mailgun dashboard, generate a new key with the appropriate role, and update every application that used the old one. [1]
  2. Then review your account activity logs for unauthorized use, and consider IP allowlisting so a leaked key cannot be used from elsewhere. [1]
  3. Give the new key the most restrictive role that works; Mailgun notes a key's role cannot be changed after creation, so a wrong one means another new key. [1]

Sources

  1. API key management: roles and security best practices — Mailgun Documentation — checked 2026-09-25.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 229 detectors, with a page for 46 secret types, and how to delete a chat you already sent.