Secret Scanner
Is there a secret in my code?
An API key that reaches a commit stays in your git history after you delete the line, and one that reaches client code ships to every visitor. Paste a file, a .env, or a diff here before it goes anywhere, and this secret scanner flags every key format it recognizes without the text ever leaving your browser.
Runs in your browser. The text and files you scan are never uploaded.
What this secret scanner detects
AI provider keys
OpenAI, Anthropic, and Groq API keys, the ones that turn a leaked file into somebody else's inference bill.
Payment and email keys
Stripe and Paystack secret keys, plus SendGrid, Resend, and Mailgun API keys.
Read more →Cloud and platform tokens
AWS access keys, GitHub and GitLab tokens, and Cloudflare, Vercel, and Netlify API tokens.
Database credentials
Postgres, MySQL, MongoDB, and Redis connection strings with a password in them, Upstash tokens, and Supabase service-role keys.
Read more →Private keys and signing secrets
RSA, EC, OpenSSH, and service account private keys, plus NEXTAUTH_SECRET, JWT_SECRET, OAuth client secrets, and webhook signing secrets.
Bot tokens and generic keys
Slack, Discord, and Telegram bot tokens and Twilio credentials, plus generic API_KEY and SECRET_KEY assignments flagged at lower confidence.
Read more →How the Secret Scanner works
- Step 1
Paste or drop your files
A .env, a source file, a config file, or a git diff. Nothing uploads: the files are read and scanned on your own machine.
- Step 2
It matches known key formats
Every line is checked against the same patterns the Ubserve live scanner uses on deployed apps. Keys that are public by design, like a Supabase anon key, are marked as low risk instead of raising an alarm.
- Step 3
Rotate, then check what already shipped
Rotate anything real first. Then run the live scan on your deployed URL, because a key found here may already be sitting in the JavaScript your app serves.
Frequently asked questions
How do I check my code for exposed API keys?
Paste the file or diff into this page, or search it yourself for the prefixes providers use: sk_live_ for Stripe, sk- for OpenAI, AKIA for AWS, ghp_ for GitHub, and eyJ for a JWT. Command-line tools like gitleaks and trufflehog do the same across a whole repository. This page is the no-install version for a single file, a .env, or the diff you are about to commit.
What is secret scanning?
Secret scanning is the automated search for credentials in code, config files, and commit history, usually by matching the known formats providers give their keys. It matters because a secret committed once stays in the repository's history after the line is deleted, and anyone with a copy of the repository can read it. Scanning before a commit is the cheapest point to catch one, since a key that never reaches a commit never needs rotating.
How is this different from GitHub secret scanning?
GitHub secret scanning checks repositories hosted on GitHub, across the full git history on every branch, and is free for public repositories. This page needs no repository at all: it scans a file or a diff before it is committed, including code that is not on GitHub. Neither one looks at your deployed app, which is where a key that slipped into client code actually becomes public. The Ubserve live scan covers that part.
Is it free? Do I need to sign in?
It is completely free and there is no account, no sign-in, and no limit on how many times you use it. Ubserve makes money from the paid security report, not from this page. The scanner it pairs with is free to run too - you get a grade, an issue count, and up to two findings in full before anything is asked of you.
Does anything I paste get sent to Ubserve?
No. The scan runs as JavaScript on your own machine: pasted text and dropped files are read locally and matched in memory, and none of it is uploaded or stored. You can confirm it by opening DevTools and watching the Network tab while you scan. If a real key was already committed or shared somewhere before you pasted it, rotate it regardless, because the exposure happened there.
I found a real key. What should I do?
Rotate it first, in the provider's dashboard, before cleaning up the code. Deleting the line does not recall a key that was committed or shared, and rewriting git history does not recall clones that already exist. Then move the value into a server-side environment variable, never one prefixed NEXT_PUBLIC_ or VITE_, which bundlers ship to the browser. Finally, check whether it already reached your deployed app with the live scan.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →Exposed API Key Scanner
Downloads your deployed JavaScript and matches it against key patterns for 30+ providers, from Stripe to OpenAI to AWS.
Open tool →Exposed .env Checker
Requests the dotfiles, backups, and source maps your host might be serving, and checks whether env values reached the bundle.
Open tool →Website Vulnerability Scanner
The full public scan: bundles, headers, TLS, CORS, endpoints, DNS, and database exposure in a single pass.
Open tool →Keep reading
- I exposed an API key - what now?The rotation order that limits the damage.
- How to remove exposed API keys from your frontendGetting a secret back behind a server route.
- Stripe secret key exposureWhat sk_live in the open actually costs.
- Supabase service-role key exposureThe key that bypasses every policy you write.
- Pre-deploy security checklist for vibe-coded appsThe last pass before you ship.
Check what your live app serves
Anything you check here only covers what you hand it. What an attacker sees is what your deployed app serves, so paste your URL and check that too.