for AI-built apps

Check my AI app for leaked API keys

Built with Cursor, Claude, ChatGPT, Lovable or Bolt? Paste your link and we look for secret keys in what your site sends to the browser. Under a minute, no sign-up.

Only scan apps you own or have permission to scan.

why.txt

Why AI-built apps leak keys

When you ask an AI tool to "just make it work", it may put an API key straight into frontend code. Anything in your frontend is downloadable by every visitor.

A leaked secret key can be used by someone else to run up your bill or reach your accounts.

what_we_check.log

What the free scan checks

Leaked keys in your frontend
Your page HTML and up to 15 of your own JavaScript files are checked for Stripe live secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.
Supabase service_role key
A Supabase service_role key in your client code is flagged as critical. That key skips Row Level Security entirely.
Files left on the server
Things like /.env, /.env.local, /.env.production, /.git/config, .npmrc, docker-compose.yml, backup files, and package.json or lockfiles.
Public source maps
We check whether a source map for one of your JavaScript files can be downloaded, which would expose your original source.
Security headers and CORS
HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.
Open tables (owner opt-in)
If you use Supabase, tick the extra box and we ask 15 common table names (like users, profiles, orders) for 1 row using your public anon key. Row contents are never stored or shown.

checklist.txt

If a key leaked, do this

Rotate the key now. Create a new key in the provider's dashboard and revoke the old one. Removing it from code is not enough.
Move the call server-side. Call the API from a server route or edge function and read the key from an environment variable.
Check your usage. Look at the provider's usage and billing pages for activity you don't recognize.
Set spend limits. Most providers let you cap usage. Turn that on.
Scan again. Run the free scan after you redeploy to confirm the key is gone.

faq.txt

FAQ

Which keys does it look for?: Stripe live secret and restricted keys, OpenAI, Anthropic, AWS access key IDs, GitHub tokens, Slack, Resend, Google API keys, private key blocks, and Supabase service_role keys.
Where does it look?: Your page HTML and up to 15 JavaScript files served from your own domain. Third-party scripts are skipped.
Do I need to sign up?: No. Paste your link, confirm it's your app (or you have permission), and run it. Adding your email is optional and shows the risk breakdown and one problem by name.
What does it cost?: The scan and your score are free. The full list of findings with a fix for each is a one-time $9, or $29 for a pack of 10 reports.
Does it attack my site?: No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.
What doesn't it check?: Pages behind a login, third-party scripts, your server code and your database policies directly. A good score is not a guarantee of security.

Run the free scan