Leaked-key scanner

Apps built quickly with AI tools often ship secret keys inside the code the browser downloads. Choose your project folder or paste code, and see which keys are exposed and how to fix each one.

🔒 Your code is read by your browser only. It is never uploaded.

Your project folder

Skips node_modules, .git, build folders, images and files over 1 MB. Tip: also scan your built output (dist, build or .next/static), because that is what visitors actually download.

…or paste code, a .env file or a bundled JS file

Only scan code you own or have permission to check.

What it looks for

Secret keys for OpenAI, Anthropic, Stripe (live and test), AWS, GitHub, Slack and Google, plus private key files.
Supabase keys, decoded: an anon key is meant to be public, but only safe with Row Level Security on. A service_role key bypasses all security and must never reach the browser.
Variables like NEXT_PUBLIC_…SECRET or VITE_…TOKEN: anything with those prefixes is bundled into the browser.

Why it matters: a public vulnerability (CVE-2025-48757) described Lovable-generated apps whose Supabase tables could be read without logging in. Lovable disputes it. Escape.tech's October 2025 scan of over 5,600 public "vibe-coded" apps found over 2,000 vulnerabilities and over 400 exposed secrets. A pattern scan like this one can miss things and can flag test keys. It is a first check, not a security audit.

Found something, or want a full check? Vihsm reviews AI-built apps (Supabase Row Level Security, auth, exposed keys, security headers) and fixes them at a fixed price, with your written permission.

Ask for a review