That's a really interesting idea. Generate unique tokens e.g. for detecting leaked passwords and alert upon any text match within database, logs, etc.

Azure has this built into some of their DLP...at least when looking at emails

It wouldn't just be for passwords. It would be for any kind of confidential data.

Set an one time url as a password. Someone accesses it bam.

The detector would have to run everywhere, not just on your web application. It'd have to check linux/nginx/apache/etc logs, metric systems transit pipes and storage, etc, etc.

I guess you could install it as a Linux system which searches through all plaintext traversing the network AND filesystems of the entire infrastructure. Which might be a good business idea if you could pull it off.