Is my API key exposed? Check your site’s JavaScript
Last updated
Enter a URL to search the page and its same-site JavaScript files for secret keys from more than twenty providers, database connection strings and AI provider calls made straight from the browser. Public-by-design keys such as Stripe publishable or Supabase anon keys are not reported, and anything found is masked.
What counts as a leak
A key is leaked when anyone can copy it from your site and use it to spend money or read data: secret payment keys, AI provider keys, cloud credentials, service_role keys and database passwords. Keys designed for browsers, which only work within rules you set at the provider, are not reported.
Questions
- I found a key. What now?
- Rotate it at the provider immediately, check usage and billing, then move the call that needs it to server code. The guide on checking for leaked API keys walks through it.
Related Defexity checks
Defexity reports potential risks it can see from outside your app. It is not a guarantee of security and not legal advice.