Replit
Exposed API keys on a Replit app
A Replit deployment is an ordinary website. The page, its same-origin scripts, and the headers from that host are what a visitor receives, and what this scan reads.
Keys that the browser can already download.
What the scan can see
The scan looks for high-confidence shapes in the HTML, up to 10 same-origin scripts, and a public env file: Stripe secret and webhook keys, OpenAI, Anthropic, AWS access key ids, GitHub and Slack tokens, Supabase service_role JWTs, and private keys. A Stripe publishable key and a Supabase anon key are notes, not leaks. The stored report keeps a short prefix and suffix, not the full secret.
What it does not do
Keys on other hosts, keys assembled at runtime, and keys that never shipped are missed. The scan does not call the provider to see if a key still works.
The Replit API, the workspace, and secrets that exist only in Replit's server environment are outside the fetch.
What to do next
Roll a live secret in that provider's dashboard first. Then remove it from client code and from any public env prefix. The $9 report is a paste-ready prompt for Lovable, Cursor, and Bolt that names the file path we saw.
Questions
Does this open my Replit project?
No. The Replit API, the workspace, and secrets that exist only in Replit's server environment are outside the fetch.
Can the scan prove exposed api keys is fully fixed?
Keys on other hosts, keys assembled at runtime, and keys that never shipped are missed. The scan does not call the provider to see if a key still works.
What should I do if the scan finds it?
Roll a live secret in that provider's dashboard first. Then remove it from client code and from any public env prefix. The $9 report is a paste-ready prompt for Lovable, Cursor, and Bolt that names the file path we saw.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.