Scan a public page for 25 kinds of leaked secrets
Apps made by vibe coding often ship keys to the browser. Enter the address of one page you run, and the scanner reads that page’s HTML and the script files it links for API keys, tokens and database URLs that a visitor could copy. Values are shown masked.
Result
What this scan cannot see
The scanner reads only the files a visitor’s browser downloads from the page. It cannot see secrets that stay on the server, pages behind a login, files loaded later by import(), or source maps. A clean result is not proof that the app is safe.
All 25 key types
20 of them are secrets that must never reach a browser. 5 are public by design.
Keys marked public, such as a Supabase anon key, a Firebase apiKey or a Stripe publishable key, are meant to be in the browser. They are safe only while your database rules protect the data behind them.
| Key type | Id | Severity | Kind |
|---|---|---|---|
| OpenAI API key | openai-key | Critical | Secret |
| Anthropic API key | anthropic-key | Critical | Secret |
| Stripe live secret key | stripe-secret | Critical | Secret |
| Stripe test secret key | stripe-test-secret | Medium | Secret |
| Stripe publishable key | stripe-publishable | Info | Public by design |
| AWS access key id | aws-access-key | High | Secret |
| AWS secret access key | aws-secret | Critical | Secret |
| GitHub token | github-token | Critical | Secret |
| Google API key | google-api-key | Info | Public by design |
| Firebase web config apiKey | firebase-web-config | Info | Public by design |
| Supabase service_role key | supabase-service-role-jwt | Critical | Secret |
| Supabase anon key | supabase-anon-jwt | Info | Public by design |
| JSON Web Token | jwt-other | Low | Secret |
| Supabase secret key | supabase-secret-key | Critical | Secret |
| Supabase publishable key | supabase-publishable-key | Info | Public by design |
| Slack token | slack-token | Critical | Secret |
| Slack webhook URL | slack-webhook | High | Secret |
| SendGrid API key | sendgrid-key | Critical | Secret |
| Twilio API key sid | twilio-key | High | Secret |
| Mailgun API key | mailgun-key | High | Secret |
| Private key block | private-key-block | Critical | Secret |
| Database URL with password | database-url | Critical | Secret |
| npm token | npm-token | Critical | Secret |
| Hugging Face token | huggingface-token | High | Secret |
| Resend API key | resend-key | High | Secret |
Questions
What does the secret scanner read?
It reads the page’s HTML and up to 14 script files it links, 3 MB in total, the first 512 KB of the page and the first 1 MB of each file. It looks for known key formats, such as API keys, access tokens, private key blocks and database URLs with a password.
Where does the scan run, and how long does it take?
The scan runs in your browser; our server only fetches the files for it, one request per file. Nothing is stored. A scan can take up to about a minute and a half on a slow site.
What can the scanner not see?
Secrets that exist only on the server, pages behind a login, chunks that the page loads later by import(), and source maps. It also cannot tell whether a found key is still active. A clean result is not proof that the app is safe.
Why are some keys marked public by design?
A Supabase anon or publishable key, a Firebase apiKey, a Google API key and a Stripe publishable key are made to be sent to the browser. They identify your project and grant only what your database rules, API restrictions and server checks allow. They are reported so you can confirm those rules exist, not because the key itself is a leak.
What should I do if a real secret leaks?
Rotate it first: create a new key at the provider and revoke the old one. Then move the new key to server-side code or environment variables and redeploy. Deleting the key from the code is not enough, because the old value stays in earlier builds, caches and git history.
Why do apps built by vibe coding leak keys so often?
Code written quickly with AI tools often calls a paid or privileged API straight from the browser, and the key ends up in the script that every visitor downloads. Vibe coding security starts with keeping such calls on the server.