Exposed API Key Scanner
Is my API key exposed in my app?
Anything your frontend imports gets bundled and shipped to every visitor, so one secret pasted into client-side code becomes a public string in a file anyone can download. This scanner fetches the JavaScript your live app actually serves and matches it against key patterns for more than thirty providers.
Keys and secrets this scanner matches
Payment and billing keys
Stripe secret keys and Paystack secret keys found in shipped client code.
Read more →AI provider keys
OpenAI, Anthropic, and Groq API keys - the ones that turn your bundle into somebody else's inference budget.
Database and backend keys
Supabase service-role keys and JWT secrets, Firebase private keys, and Postgres, MySQL, MongoDB, and Redis connection strings.
Read more →Cloud and infrastructure tokens
AWS access keys, Cloudflare API tokens, Vercel tokens, Netlify auth tokens, GitHub and GitLab tokens, and raw private key blocks.
Messaging and delivery credentials
Twilio SIDs and auth tokens, SendGrid, Resend, and Mailgun API keys, plus Slack, Discord, and Telegram bot tokens.
Source maps and .env files on the host
Published source maps and .env files served from your web root are the other common way a secret goes public - both are probed on the same run.
Read more →How the Exposed API Key Scanner works
- Step 1
Paste your app URL
The live URL is all we need. No repository access, no CI integration, no environment file upload, and no Ubserve account.
- Step 2
We download the JavaScript your app serves
We fetch the page, follow its script tags and chunk references to the bundles behind them, and run every provider pattern across the contents. We also request common paths like .env, .env.production, and published source maps, to catch secrets that leak through misconfigured static hosting rather than through the bundle.
- Step 3
You get the report, partially unlocked
You see the issue count, a letter grade, and up to two findings in full, free. The rest - including the highest-severity findings and the copy-paste fix prompts - unlocks with a one-time report unlock or a plan.
Frequently asked questions
How do I know if my API key is exposed?
Open your deployed site, view source or open the Network tab, and search the JavaScript files your page downloads for the prefix your provider uses - sk_live for Stripe, sk- for OpenAI, eyJ for a Supabase JWT, AKIA for AWS. If the string is in a file your browser fetched, it is public: every visitor, crawler, and archive already has a copy. Rotating the key is the only real fix, because you cannot un-publish something that has already been served.
What actually counts as an exposed key?
There are two kinds of key and only one of them is a problem in a browser. Publishable keys - a Stripe pk_, a Supabase anon key, a Firebase web config - are designed to be public and are backed by server-side rules, so finding one is normal. Secret keys are the ones that authenticate as you: a Stripe sk_live can move money, an OpenAI key can spend your balance, a Supabase service_role key ignores Row Level Security entirely. Any secret key reachable from client-side code is exposed, no matter how deeply it is minified, because minification is not encryption.
How does the scanner work?
It runs the standard Ubserve public scan. We fetch your URL, follow the script tags and chunk references to the JavaScript bundles your app serves, download them, and match the contents against key patterns for more than thirty providers, including Stripe, OpenAI, Anthropic, Supabase, Firebase, AWS, Twilio, SendGrid, Cloudflare, GitHub, and Clerk. We also probe the common paths where secrets leak outside the bundle - .env files and published source maps served from your web root.
Is it free? Do I need to sign in?
The scan is free and you do not need an account to run it. You get the issue count, a letter grade, and up to two findings shown in full - location, evidence, and severity - at no cost. The rest of the report stays locked, including the highest-severity findings and the copy-paste fix prompts you can hand to your AI coding tool. Unlocking everything is a one-time payment for that report, or a plan if you want repeat scans and monitoring.
Does Ubserve see my source code or private repository?
No. This scan only reads what your app already serves to the public: the HTML at your URL, the JavaScript bundles that page links to, HTTP response headers, TLS certificate details, and public DNS records. We never ask for a repository, a database password, a service-role key, or an app login, and we cannot see private source code or authenticated pages. When we find a secret in your bundle, we found it because your browser downloads it too - anyone viewing your site can read the same bytes.
Do you use the keys you find?
No. We match the pattern, record where in your bundle it appeared, and store that as evidence in your report so you can find and rotate it. We do not call the provider to test whether a key is live, we do not charge anything against it, and we do not use it to reach any account of yours. Every probe this scan makes is a read against your own public URLs.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →Secret Scanner
Paste code, a .env file, or config and find API keys and credentials before you commit. Runs entirely in your browser.
Open tool →Exposed .env Checker
Requests the dotfiles, backups, and source maps your host might be serving, and checks whether env values reached the bundle.
Open tool →Website Vulnerability Scanner
The full public scan: bundles, headers, TLS, CORS, endpoints, DNS, and database exposure in a single pass.
Open tool →Keep reading
- I exposed an API key - what now?The rotation order that limits the damage.
- How to remove exposed API keys from your frontendMoving a secret behind a server route without breaking the app.
- Stripe secret key exposureWhat an attacker can do with sk_live before you notice.
- Supabase service-role key exposureThe key that bypasses every RLS policy you wrote.
- Pre-deploy security checklist for vibe-coded appsWhat to verify before the app goes live.
Run the Exposed API Key Scanner
Paste your URL and see what your app is handing to the public. Free, no account, no repo access.