API Key Exposure Scanner

Detect exposed API keys, tokens, and secrets in your frontend code and responses.

How this scan works

Fetch HTML plus same-origin linked JS bundles
Regex-match known key shapes: AWS (AKIA…), Stripe (sk_live_…/pk_live_…), Google API (AIza…), Supabase anon/service JWT, Firebase apiKey, database connection strings with embedded credentials (postgres://user:pass@…, mongodb+srv://…), and generic 32+ char high-entropy strings assigned to key/secret/token variables
Probe /.env, /.env.local, /config.json for accidental static-file exposure
Cross-reference any found Supabase/Firebase URL for use by those dedicated scanners