Exposed key
AWS key exposed: what to do
An access key id in the client is a sign the secret key may have been handled the same way. If both were in the bundle, treat them as copied.
How to recognize it
The scan recognizes AWS access key id shapes in the public files. It does not see a secret access key that was never shipped.
What to do
Deactivate the key in IAM, issue a new key for the server only, and search the deployed JavaScript for the AKIA prefix.
Paste the public URL of an app you own. The scan reads the page, up to 10 same-origin scripts, and /.env, /.env.local, and /.env.production. It does not search the whole internet, and it does not submit the key to AWS to see if it still works.
What does an exposed AWS key look like?
The scan recognizes AWS access key id shapes in the public files. It does not see a secret access key that was never shipped.
Do you store the key if the scan finds one?
No. The report stores a masked fragment and the kind of key. The full value is not written to the database, and the fix prompt does not repeat it.
What should I do with a leaked AWS key?
Deactivate the key in IAM, issue a new key for the server only, and search the deployed JavaScript for the AKIA prefix.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.