Exposed keys check
Runs in every scan · 6 checks
Find secret keys left in code every visitor downloads, and see which visible keys are perfectly normal.
What we check
Part of every Quick Scan, alongside the other checks.
Payment, cloud, email, code-hosting and chat keys.
Signing keys and tokens that carry admin rights.
Publishable and browser keys shown as normal, with a tip on restrictions.
Values that look like keys inside HTML comments.
Internal network addresses and technical error pages on your homepage.
A note when your pages reference many API addresses.
Why it matters
Catch a leaked key before anyone uses it.
Cloud and email keys can't be spent by others.
Public-by-design keys are labelled as such.
What a finding looks like
K1 · exposed-keys
/assets/app.js
SG.••••••••••••.••••7Qx (shown shortened)How to fix it
Your report has the exact fix for your site, ready to forward to whoever looks after it.
Revoke the exposed key in the provider's dashboard and issue a new one.
Call the provider from your server or a serverless function, so the key never reaches the browser.
Restrict keys that are meant to be public to your own domain, and check their access rules.
Add a secret scanner to your build so a key can't slip into a bundle again.
// server-side only, never in the browser bundle
const key = process.env.EMAIL_API_KEY;No. Publishable keys, Firebase web configuration and Supabase anon keys are made to be shipped to browsers. The report shows them as normal and suggests checking their restrictions and access rules in each provider's dashboard.
Revoke it and issue a new one first, then move the code that uses it to your server. Removing it from the script alone isn't enough, because copies may already exist.
Never. We don't try a key, and the full value isn't stored: the report shows a shortened form so you can recognise it.
The scripts your homepage loads, including ones from your own build and from other sites. Code that only loads after sign-in sits outside a Quick Scan.
Keep exploring
Also useful: What we check Sample report Pricing For developers
One report, a fix for every finding