Exposed key
Anthropic key exposed: what to do
A copied key can spend your Anthropic quota. The browser should call your server, not Anthropic directly with that key.
How to recognize it
An Anthropic API key starts with sk-ant-.
What to do
Revoke it in the Anthropic console, create a new key for the server only, and confirm the shipped JavaScript no longer contains sk-ant-.
Paste the public URL of an app you own. The scan reads the page, up to 10 same-origin scripts, and /.env, /.env.local, and /.env.production. It does not search the whole internet, and it does not submit the key to Anthropic to see if it still works.
What does an exposed Anthropic key look like?
An Anthropic API key starts with sk-ant-.
Do you store the key if the scan finds one?
No. The report stores a masked fragment and the kind of key. The full value is not written to the database, and the fix prompt does not repeat it.
What should I do with a leaked Anthropic key?
Revoke it in the Anthropic console, create a new key for the server only, and confirm the shipped JavaScript no longer contains sk-ant-.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.