Public Key & Secret Scanner
Scan a live site's public HTML and JavaScript for leaked API keys and secrets — redacted results only.
Scan a live site
Enter a public URL. The scan runs server-side against that page and up to 4 same-origin internal pages (plus each page's linked scripts), checking for common leaked-secret patterns — only redacted matches are shown, never the full key.
How it works
A scan of thousands of publicly deployed AI-generated apps found hundreds of exposed secrets in exactly this way — a full-access key checked into a client bundle meant for a browser. This tool automates the same check a security researcher would do by hand: view the page source, view the linked scripts, grep for known key formats. Related reading: what a headless CMS's read-only delivery key model gets right.
Use a key that's safe to expose
Draftbase's delivery API key is read-only by design, so it's safe in a public bundle with no proxy or server-side hiding needed — unlike a full-access database key.
Hobby is free, no card. Startup is $49/mo when you outgrow it. The price is on the pricing page, where prices go.
No migration quarter, no kickoff workshop. Define a template and ship something today.
Frequently asked questions
How does this find leaked secrets?
It fetches the page and up to 8 linked JavaScript files, then pattern-matches against known secret formats — Stripe live keys, AWS access key IDs, GitHub tokens, private key blocks, Supabase service_role JWTs, and a generic secret-assignment pattern. It only reports a redacted snippet, never the full match.
Is this legal to run against any site?
It fetches only what a browser already loads when visiting the page — the same public HTML and JS anyone gets by viewing source. Run it against sites you own or have permission to test; treat a finding on someone else’s site as a responsible-disclosure lead, not an invitation to use it.
Why does a finding not always mean I’m compromised?
Some matches are false positives — test keys, example strings in documentation embedded in a page, or keys that are meant to be public (like a Stripe publishable key, which starts pk_, not sk_). Treat every finding as something to verify by hand, not an automatic incident.
Why does the scan run on your server instead of my browser?
Browsers block a page from reading another site’s response body across origins (CORS) unless that site opts in, so a client-side scanner can’t read most external pages. Running the fetch server-side avoids that restriction — it’s the same reason a security-headers checker or SSL checker also runs server-side.
More free tools on the tools page, or read the headless cms guide on /headless-cms.