for OpenAI API apps

Is your OpenAI API key exposed?

No signup 路 no repo or GitHub access needed 路 passive, read-only checks 路 results in under a minute

See a sample report

If your app calls OpenAI from the browser, your key may be in your frontend code. Paste your link and we'll look. Under a minute, no sign-up.

Only scan apps you own or have permission to scan.

why.txt

How OpenAI keys end up public

Calling the OpenAI API directly from a React or Next.js component is the quickest way to get a demo working. It also ships your secret key to every visitor.

Custom frontends for GPT-style apps are a common place to find this.

what_we_check.log

What the free scan checks

  • Leaked keys in your frontend

    Your page HTML and up to 15 of your own JavaScript files are checked for Stripe live secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.

  • Files left on the server

    Things like /.env, /.env.local, /.env.production, /.git/config, .npmrc, docker-compose.yml, backup files, and package.json or lockfiles.

  • Public source maps

    We check whether a source map for one of your JavaScript files can be downloaded, which would expose your original source.

  • Security headers and CORS

    HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.

checklist.txt

If your OpenAI key is exposed

  1. Revoke it. In the OpenAI dashboard, delete the exposed key and create a new one.
  2. Proxy through your server. Send requests from a server route or edge function that holds the key in an environment variable.
  3. Add limits. Set a usage limit for your project and rate limit your own endpoint.
  4. Check usage. Review recent usage for requests you didn't make.
  5. Scan again. Run the free scan after you redeploy.
faq.txt

FAQ

Does it detect every OpenAI key format?
It detects the common current secret key formats, including project keys (sk-proj-). Older or unusual formats may not be matched, so a clean result is not proof.
Does it work for custom GPTs?
It checks websites. If you have your own site or frontend that talks to the OpenAI API, scan that URL. It can't see inside ChatGPT itself.
Do I need to sign up?
No. Paste your link, confirm it's your app (or you have permission), and run it. Adding your email is optional and shows the risk breakdown and one problem by name.
What does it cost?
The scan and your score are free. The full list of findings with a fix for each is a one-time $9, or $29 for a pack of 10 reports.
Does it attack my site?
No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.
What doesn't it check?
Pages behind a login, third-party scripts, your server code and your database policies directly. A good score is not a guarantee of security.

Run the free scan