Is your AI-built app leaking API keys?
Apps built with Lovable, Bolt, v0, Cursor or Replit often call OpenAI, Stripe or Supabase straight from the browser. When they do, the secret key ships inside the JavaScript every visitor downloads, and anyone can copy it to run up your bill or get into your data. Paste your address: we read your home page and the script files it loads, and tell you which secret keys are exposed. Free, no sign-up, under a minute.
Good to know
A key is exposed. What do I do?
Revoke it at the provider and create a new one first. Deleting it from your code is not enough, because the old version has already been downloaded. Then move the call that needs it to the server side, such as a Supabase Edge Function, a Next.js API route or your platform's server functions, and keep the key in a server-only environment variable.
How did the key end up in the browser?
Build tools put some environment variables into the browser code on purpose: in Vite, which many Lovable and Bolt apps are built on, every variable starting with VITE_; in Next.js, every one starting with NEXT_PUBLIC_. A secret key under one of those names is shipped to every visitor.
Isn't my Supabase anon key a leak too?
No. The anon (publishable) key is meant to be in the browser; what protects your data is row-level security on each table. The service_role key bypasses those rules, and that is the one this check looks for.
Do you keep the key?
No. The result names the provider only, the key itself is never shown, and the result is deleted after 30 minutes.
What this checks
- OpenAI and Anthropic API keys
- The Supabase service_role key and the new sb_secret_ keys. The public anon / publishable key is meant to be in the browser and is never reported
- Stripe secret and restricted keys (sk_live_, rk_live_)
- AWS access keys; GitHub, Slack, SendGrid, Groq, Hugging Face and Replicate tokens; and private keys
This reads your home page and the script files it loads from your own domain (up to 20). It does not see code that loads only on other pages, only after login or from another domain, nor keys kept on your server, which is where they belong. It does not test your database's access rules (for example, Supabase tables without row-level security). A clean result means we found no key we recognise in what we read, not that the app is secure.