Free check

Are API keys leaking from your JavaScript?

Anything in your website's HTML or JavaScript is public, including keys a developer meant to keep secret. This check reads your pages and scripts the way an attacker would and flags keys that should never reach a browser.

Why it matters

Secret keys in front-end code let anyone use your accounts: charge cards through your Stripe account, run up an AI or cloud bill, or read your data.

It often happens by accident: frameworks expose any environment variable with a public prefix (NEXT_PUBLIC_, VITE_, REACT_APP_) to the browser, and it's easy to add one to the wrong variable.

What this check looks at

Inline scripts on up to five pages, and your own JavaScript files
Stripe live secret keys, AWS access keys, GitHub and Slack tokens, AI provider keys, private keys
Hard-coded passwords and secrets assigned to variables like apiKey, secret or password
Google API keys (often meant to be public, but they should be restricted)

How to fix it

Move the call to your server

// Browser: call your own endpoint instead of the provider directly
const res = await fetch("/api/summarise", { method: "POST", body: JSON.stringify({ text }) });

// Server (e.g. a Next.js route or Express handler) keeps the key private
const key = process.env.PROVIDER_API_KEY; // never exposed to the browser

Framework prefixes that expose variables

These prefixes are compiled into browser code. Never use them for secrets:
  Next.js:            NEXT_PUBLIC_*
  Vite:               VITE_*
  Create React App:   REACT_APP_*
  Nuxt:               NUXT_PUBLIC_*
  SvelteKit:          PUBLIC_*

If a key leaked

1. Revoke or roll the key in the provider's dashboard now.
2. Check the provider's usage logs for activity you don't recognise.
3. Move the call server-side, then deploy with a new key.

Questions

Is a Stripe publishable key a problem?

No. Publishable keys (pk_live_...) are designed to be public. Secret keys (sk_live_... or rk_live_...) must never appear in front-end code.

Are Google Maps or Firebase keys safe to expose?

They're designed to be used in browsers, but restrict them in the Google Cloud console by HTTP referrer and to the APIs you use, so nobody else can spend your quota.

Do you show the key you found?

No. Values are masked in the result: we show only enough characters for you to recognise which key it is.