Windsurf
Exposed API keys on a Windsurf app
Windsurf's agent edits a project you deploy yourself. The public check is of that deployment. Secrets the agent wrote into client code show up if the browser downloads them.
Keys that the browser can already download.
What the scan can see
The scan looks for high-confidence shapes in the HTML, up to 10 same-origin scripts, and a public env file: Stripe secret and webhook keys, OpenAI, Anthropic, AWS access key ids, GitHub and Slack tokens, Supabase service_role JWTs, and private keys. A Stripe publishable key and a Supabase anon key are notes, not leaks. The stored report keeps a short prefix and suffix, not the full secret.
What it does not do
Keys on other hosts, keys assembled at runtime, and keys that never shipped are missed. The scan does not call the provider to see if a key still works.
The scan does not read the Windsurf session or your local files.
What to do next
Roll a live secret in that provider's dashboard first. Then remove it from client code and from any public env prefix. The $9 report is a paste-ready prompt for Lovable, Cursor, and Bolt that names the file path we saw.
Questions
Does this open my Windsurf project?
No. The scan does not read the Windsurf session or your local files.
Can the scan prove exposed api keys is fully fixed?
Keys on other hosts, keys assembled at runtime, and keys that never shipped are missed. The scan does not call the provider to see if a key still works.
What should I do if the scan finds it?
Roll a live secret in that provider's dashboard first. Then remove it from client code and from any public env prefix. The $9 report is a paste-ready prompt for Lovable, Cursor, and Bolt that names the file path we saw.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.