ScanYourSite

Find the API keys your site gives away

Anything in your frontend is downloaded by every visitor — including a key you pasted in to make a feature work. We scan the page and the scripts it loads for known secret-key formats and show you where they are.

Free, no sign-up. The basic check makes only the requests an ordinary browser would.

See a full example report

Keys we recognise

Check it yourself

Your browser already has every file a stranger would get. Here is how to search them by hand.

  1. Open everything the page loaded

    Open your live site, then DevTools → Sources (Chrome, Edge) or Debugger (Firefox). Reload so every script is listed.

  2. Search all files for key prefixes

    Cmd/Ctrl + Option/Alt + F searches every loaded file at once. Try each of these; a match is worth a closer look.

    sk_live_      Stripe secret
rk_live_      Stripe restricted
sk-proj-      OpenAI
sk-ant-       Anthropic
AKIA          AWS access key
ghp_          GitHub token
github_pat_   GitHub fine-grained token
xoxb-         Slack bot token
SG.           SendGrid
service_role  Supabase (decode the JWT)
sb_secret_    Supabase secret
-----BEGIN    private key

  3. Check which variables your build exposes

    Frameworks put variables with these prefixes into the browser bundle on purpose. A secret under any of them is public.

    NEXT_PUBLIC_   Next.js
VITE_          Vite, Lovable, Bolt
REACT_APP_     Create React App
PUBLIC_        Astro, SvelteKit
EXPO_PUBLIC_   Expo

  4. Found one? Revoke first

    Assume it has been copied. Revoke or roll it in the provider’s dashboard, then move the call into a server function, redeploy and search again.

What to do with a leaked key

Revoke first, then move the call to the server. The report’s prompt tells your AI exactly that, file by file.

Fix these issues on shop.example.

1. An Anthropic API key (sk-ant-…x7Q) is in assets/chat-91b.js.
   Revoke it in the Anthropic console, move the API call into a server endpoint and read the key from an environment variable there.

When done, re-check: https://scanyoursite.app/en?check=shop.example

Keys come back

An AI edit can paste the key back in. With Pro every new deploy is checked for keys within minutes.

See plans

Questions

Do you store the keys you find?

No. Reports show keys redacted — the type, the first and last few characters and the file.

Is it enough to delete the key from the code?

No. Once it has been public, assume it was copied: revoke it with the provider and create a new one.

Do you scan my repository?

No — the live site. That is what attackers see.

For vibe coders

Paste your URL. Get the list in about a minute.

Every finding comes with what it means for you and how to fix it — or a prompt your AI coding tool can apply.

Free, no sign-up. The basic check makes only the requests an ordinary browser would.