Exposed keys
Check a public app for exposed API keys
Paste a URL you own. We read the page, up to 10 same-origin scripts, and five fixed paths. High-confidence patterns in those responses become findings. The value is masked before it is saved: a short prefix, a short suffix, and the middle removed.
This is not a search of the whole internet, and it is not a scan of your git history.
What this scan actually checks
- Stripe live and test secret keys, restricted keys, and webhook signing secrets. Publishable keys are noted and are not treated as secret.
- OpenAI and Anthropic API keys.
- AWS access key ids.
- GitHub tokens and Slack tokens.
- PEM private keys and Google service-account keys.
- Supabase service_role JWTs. Anon keys are informational.
- A public /.env, /.env.local, or /.env.production when the body looks like environment assignments rather than an HTML app shell. /.git/HEAD and /.git/config when they look like git metadata.
What it does not check
- Keys inside scripts on other hosts are not fetched.
- Keys that are built at runtime from pieces, or that use a format we do not match, can be missed.
- We do not submit the key anywhere to see if it still works.
What to do with the result
- If a live secret shows up, roll it in that provider's dashboard before you worry about the rest of the list. Assume someone already copied it.
- The $9 report turns each finding into a prompt for Lovable, Bolt, or Cursor. The prompt tells the tool what to remove and where we saw it. It does not include the raw secret.
Questions
Do you store the key?
No. The report stores a masked fragment and the kind of key. The full secret is not written to the database.
What if the page is a single-page app that returns HTML for every path?
An HTML shell at /.env is not counted as an exposed env file. The same idea applies to /.git/config.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.