Base44
Exposed API keys on a Base44 app
Base44 hosts the app it builds. The hosted URL is the thing to paste. Public files and headers on that host are in scope.
Keys that the browser can already download.
What the scan can see
The scan looks for high-confidence shapes in the HTML, up to 10 same-origin scripts, and a public env file: Stripe secret and webhook keys, OpenAI, Anthropic, AWS access key ids, GitHub and Slack tokens, Supabase service_role JWTs, and private keys. A Stripe publishable key and a Supabase anon key are notes, not leaks. The stored report keeps a short prefix and suffix, not the full secret.
What it does not do
Keys on other hosts, keys assembled at runtime, and keys that never shipped are missed. The scan does not call the provider to see if a key still works.
Base44 project settings and databases are not opened. The scan does not log in as a user of the app.
What to do next
Roll a live secret in that provider's dashboard first. Then remove it from client code and from any public env prefix. The $9 report is a paste-ready prompt for Lovable, Cursor, and Bolt that names the file path we saw.
Questions
Does this open my Base44 project?
No. Base44 project settings and databases are not opened. The scan does not log in as a user of the app.
Can the scan prove exposed api keys is fully fixed?
Keys on other hosts, keys assembled at runtime, and keys that never shipped are missed. The scan does not call the provider to see if a key still works.
What should I do if the scan finds it?
Roll a live secret in that provider's dashboard first. Then remove it from client code and from any public env prefix. The $9 report is a paste-ready prompt for Lovable, Cursor, and Bolt that names the file path we saw.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.