Leaked keys in a public JavaScript bundle

AI app builders are good at wiring a key into a project. They are less careful about which file that key lands in. If it lands in a script the browser downloads, it is no longer a secret.

What the free checker reads

The public checker fetches the page, the same-origin scripts it loads, /.env, and /.git/config. It looks for live Stripe keys (sk_live_ and rk_live_), a Supabase JWT whose role is service_role, and OpenAI, Anthropic, and xAI-style keys. It also asks whether a checkout or pricing link loads, and which common security headers are missing.

It does not log in, fuzz the app, or call private addresses. A hostname that resolves to localhost, a private network, or a cloud metadata address is refused.

What to do when one shows up

Rotate the key in the provider before you do anything else. Then find the file the checker named and move the value to a server-side environment variable. A publishable Stripe key and a Supabase anon key are meant to be public. A secret key and a service role are not.

The summary on the page is free. The locations and redacted values are in the full report, which is emailed after you leave an address.