Find the API keys your website gives away.
Anyone can press Inspect on your site and copy the keys inside your JavaScript. LeakLock shows you exactly what they'd find, and how to fix it, in about ten seconds.
Works with apps built on
- Lovable
- Bolt
- v0
- Cursor
- Replit
- Next.js
- Vite
- Vercel
- Netlify
- Supabase
We scanned 978 live apps.
Public apps on Lovable, Bolt, Vercel, Netlify and Cloudflare Pages, linked from open GitHub projects. We read only what any visitor's browser downloads: 9,698 files.
apps shipped at least one secret key to every visitor's browser.
37 of 978 apps · public-by-design keys like Supabase anon and Firebase web excludedCounts are apps. Results are aggregate only: no app is named, and every key was masked during the scan.
Built for how apps really leak keys today.
AI builders move fast and put API calls right in the frontend. LeakLock checks the one place that matters: what actually ships to the browser.
Finds keys other scanners miss
Pattern scanners only know formats they've been taught. LeakLock also catches any key by how your code uses it, even a plain random string, and names the API it calls.
Sees what visitors see
HTML, every bundle, lazy-loaded chunks and public source maps.
A fix, not a lecture
Plain steps and a prompt to paste into Lovable, Bolt or Cursor.
Stops leaks before they ship
Run it in CI with the GitHub Action. The build fails when a secret is about to go live, and the run summary shows every finding.
What a visitor sees.
What LeakLock tells you.
Your build bundles your code into JavaScript files every browser downloads. If a key is in your code, it's in those files, minified but intact.
const e="d41f8b2c09e7a51f3b6d8e4a7c2f0a07", t="https://api.kie.ai/v1"; async function r(a){ const s=await fetch(`${t}/jobs`,{ method:"POST", headers:{Authorization:`Bearer ${e}`}, body:JSON.stringify({prompt:a}) }); return s.json() } const o=createClient( "https://xyzcompany.supabase.co", "eyJhbGciOiJIUzI1NiIs…" );
Sent as a Bearer token to api.kie.ai, traced through the minified variable e. Anyone can call that API as you.
Public by design. Your data is protected by Row Level Security, not by hiding this.
What anyone sees in Inspect → Sources
What LeakLock reports
Not every key starts with sk-
Many AI, image and voice APIs hand out plain random strings. Scanners that match known formats let them straight through. LeakLock watches how a value is used.
Authorization: Bearer …A value sent as a bearer token
"x-api-key": …A value in any API-key header
?key=…A value passed as a key in a URL
index.html assets/index-4f2a9c.js assets/vendor-91bc.js checked every known key format ✓ no secrets found the kie.ai key has no known format
SECRET kie.ai API key d41f…0a07 sent as a Bearer token to api.kie.ai in assets/index-4f2a9c.js SAFE Supabase anon key eyJh…c3Rw 1 secret · 1 safe (public by design)
Gitleaks checks your repo.
LeakLock checks what you ship.
A key can be clean in git and still land in your bundle through a VITE_ or NEXT_PUBLIC_ variable. Use both.
| LeakLock | Gitleaks | TruffleHog | |
|---|---|---|---|
| Scans | Your live site or build output | Git history and files | Git, files, S3, Slack and more |
| Keys with a known format | ✓30+ web and AI providers | ✓Hundreds | ✓800+ |
| Keys with no known format | ✓Found by how they're used | –Entropy rules only | –No |
| Public-by-design keys | ✓Marked safe, with the reason | –Often flagged | –Often flagged |
| Fix for each finding | ✓Steps and an AI-builder prompt | –No | –No |
| Checks if a key is still live | Planned | –No | ✓Yes |
| License | MIT | MIT | AGPL-3.0 |
Gitleaks and TruffleHog are excellent at what they do. LeakLock covers a different place keys leak.
Every finding comes with the fix.
Not just "rotate your key." You get the steps, and a prompt for the tool that built your app.
- 1Move the call to a serverA small function in Supabase, Vercel or Netlify makes the request instead of the browser.
- 2Keep the key thereStored as a server secret, never in a
VITE_orNEXT_PUBLIC_variable. - 3Scan againConfirm the key is gone from what you ship.
- 4Consider rotating itIf the key was public, someone may already have a copy.
Catch it before it ships.
Run it on a build folder, a preview URL or production. Fail the pull request when a secret is about to go live.
# a live site, any host npx leaklock scan yourapp.com # your build folder, with fixes npx leaklock scan dist/ --fix # exit 1 if a secret ships npx leaklock scan dist/ --fail-on=secret
# .github/workflows/leaklock.yml on: [push, pull_request] jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: npm ci && npm run build - uses: sgroy10/leaklock@v1 with: target: dist fail-on: secret
import { scanUrl } from 'leaklock'; const report = await scanUrl('yourapp.com'); console.log(report.summary); // { critical: 0, secret: 1, review: 0, safe: 1 } for (const f of report.findings) { console.log(f.severity, f.provider, f.masked); }
Free. Open source. Forever.
No account, no sign-up, no paid tier for scanning. LeakLock is MIT licensed, so you can read every line, run it anywhere and change it.
★Star LeakLock on GitHubQuestions, answered.
Is it safe to paste my URL here?
LeakLock only downloads the public files any browser would load from your site. Keys are masked before they leave the server, nothing is stored, and private or internal addresses are refused. Prefer your own machine? Run npx leaklock scan yourapp.com.
It found my Supabase anon key. Is that a problem?
No. The anon key is meant to be public. What protects your data is Row Level Security on every table. The service_role key is different: it bypasses all security, and LeakLock marks it critical.
Can't I just hide the key in the frontend?
No. Obfuscating, splitting or encrypting a key in the browser doesn't work, because the real key appears in the Network tab the moment it's sent. The only fix is that the key never reaches the browser.
Do I have to create a new key?
Moving the call to a server stops new copies. A key that was already public may have been copied, and rotating it is the only way to cut that off. LeakLock tells you the risk; the decision is yours.
"No keys found." Am I safe?
It's good news, not a guarantee. Keys hidden in unusual ways can be missed, and LeakLock doesn't test your database rules or server code.
Is it really free?
Yes. The web checker, CLI and GitHub Action are free with no account. LeakLock is MIT licensed open source.
Can I scan someone else's site?
Only scan sites you own or have permission to test. If you find a leak on someone else's site, tell them privately.
Scan your site before
someone else does.
About ten seconds. Free, and nothing is stored.
Useful? Star LeakLock on GitHub so more builders see it.