Find exposed API keys in your app
If a key has a public prefix, your build tool already shipped it to the browser. Paste your URL and CheckVibe scans your live JavaScript for 100+ key formats and high-entropy secrets, and shows you the exact file and line, in about 30 seconds.
Free account required to see the results
No repo and no environment file needed — CheckVibe reads only what your deployed site already serves to everyone. A live key is the last thing that should print on a public page, so the result lands in your dashboard. The account is free.
Every place a secret leaks into the browser
OpenAI, Anthropic, Stripe, AWS, Supabase, GitHub & more
Custom tokens that don’t match a known prefix
Where front-end builds leak public-prefixed vars
Service-role keys + world-readable data
The misconfig a leaked key usually travels with
Move the key server-side, for your framework
Three steps. One pasted URL.
- 01
Paste your URL
CheckVibe fetches every script and asset your deployed site serves, the attacker’s view, no access needed.
- 02
Bundles scanned for secrets
100+ key patterns plus a high-entropy detector flag leaked tokens with the exact file and snippet.
- 03
Rotate & move server-side
Each finding ships as a copy-paste fix that rotates the key and relocates it off the client, for your framework.
Frequently asked questions
- How do API keys get exposed in a deployed app?
- Front-end build tools inline anything with a public prefix (Vite ships every VITE_ variable, Next.js ships every NEXT_PUBLIC_ one) straight into the JavaScript that loads in the browser. AI code generators reach for those prefixes "to make it work," so real OpenAI, Anthropic, Stripe, and Supabase service-role keys routinely end up in the public bundle. Anyone can open DevTools and read them.
- How do I find exposed keys in my own app?
- Paste your deployed URL into CheckVibe. It downloads the same JavaScript, CSS, and source maps your visitors get and scans them against 100+ known key patterns (sk-…, sk_live_…, AIza…, AKIA…, JWT shapes, Supabase service-role tokens) plus a high-entropy detector that catches custom secrets. You get the exact file and snippet for each hit.
- Is the scan free and private?
- Yes, scanning is free, and CheckVibe only reads what your site already serves publicly. It never needs your repo or environment file. It does need a free account: a live API key is the last thing that should print on a public results page, so the list lands in your dashboard instead. Paid plans add copy-paste fix prompts and continuous monitoring so a key can’t silently come back on the next deploy.
- I found a leaked key, what do I do?
- Rotate it first (the exposed value is already compromised), then move it server-side: call the third-party API from a backend route or edge function and remove the public-prefixed variable. CheckVibe gives you a copy-paste prompt that does exactly this for your framework, then re-scan to confirm it’s gone.
- Does it catch keys in source maps and inline scripts?
- Yes. CheckVibe inspects external bundles, inline scripts, and (when published) source maps, the places AI-generated apps most often leak. It also checks for the broader set of issues a leaked key signals: open CORS, missing headers, and world-readable Supabase or Firebase data.