TruffleHog is great for this. Highly recommend. I have it constantly scanning various public systems looking for keys to immediately invalidate. Scans open s3 buckets, git repos, a text file, whatever.

One should consider running it with cron against their own resources to close the loop when preventive measures have failed to maintain secrets hygiene.

https://github.com/trufflesecurity/trufflehog