Common problem

Are your API keys exposed in your JavaScript?

Your site sends JavaScript to every visitor. If a secret key is in that code, anyone can copy it and use it. That can run up your bill or expose your data.

Check your live app for free

Paste your link. The free summary usually takes under a minute.

How keys end up in public code

A key gets pasted straight into a front-end file to make a feature work quickly.

A key is saved in an environment variable that is sent to the browser. Variables that start with NEXT_PUBLIC_, VITE_ or REACT_APP_ usually are.

Some keys are meant to be public, like a Stripe publishable key (pk_). Secret keys, like OpenAI or Stripe secret keys (sk_), must stay on a server.

What our scan checks

  • We read your page and up to 15 of your site's own script files.
  • We look for keys that look like OpenAI, Anthropic, Stripe secret keys, AWS, GitHub, Slack, SendGrid, Groq, xAI, Hugging Face, Replicate, Google OAuth client secrets and private keys.
  • Found keys are shown masked, never in full.
Example fix prompt

Fix prompt from a full report (for a leaked OpenAI key)

Paste this into your AI builder
In my AI app builder (Lovable, Bolt, Cursor, Replit, v0 or similar):
My OpenAI API key is exposed in my front-end JavaScript.
1. Move every OpenAI call to a server-side function or API route. Read the key from a server-only environment variable.
2. Remove the key from all client-side files and from any env variable that starts with NEXT_PUBLIC_, VITE_ or REACT_APP_ (those get shipped to the browser).
3. Make sure the browser calls my own server/API route, and only the server talks to the outside service.
4. Show me every file you changed.
(I will make a new key in the provider's dashboard and turn off the old one myself.)

The full report gives a prompt like this for every issue it finds, written for your site.

This is an automated, surface-level check of what your site shows the public. It is not a full security audit.