API key leak checker
A secret key is meant to stay on your server. When it ships in the code the browser downloads, anyone can copy it. This free checker reads your live JavaScript and looks for keys that should not be there.
Run the check
Free, read-only, no signup. This runs a full xlogs scan and reports this issue plus anything else it finds.
What this checks
It scans your shipped bundles against known key formats for Stripe, OpenAI, AWS, Google, Supabase and more. It flags secret and service keys, and deliberately does not flag public keys that are designed to ship, like the Supabase anon key.
Why it gets missed
To make a feature work, an AI tool sometimes pastes a key straight into a file instead of a server-only environment variable. It runs fine, so nothing warns you, and if that file is part of the frontend the key reaches every visitor.
See the full step-by-step fix, with a copy-paste block for your AI tool →