Free tool
Check a public site for leaked keys
Paste the live URL. This looks at the HTML and the scripts that come from that same site. It flags a Supabase service role or sb_secret_ key, a Stripe sk_ or rk_ key, an OpenAI or Anthropic key, an AWS access key id, and a missing Content-Security-Policy, Strict-Transport-Security, or X-Frame-Options header. After a finished scan you can buy the $15 deep report.
The check is not saved. We do not keep the URL or the results. Only the first few characters of a key are shown. Private addresses, such as localhost, are refused.
Security headers
Deep Leak Report · $15
Get the full report
The deep scan reads up to 25 same-origin scripts, public source maps, whether /.env or/.git/config is reachable, a Supabase anon-key read of users andprofiles, a CORS wildcard, cookie flags, and the rest of the security headers. File contents and table rows stay off the page. You get an HTML report and a PDF.
Keep going on your own.
The guides stay free. A deep leak report is $15. Fix packs are $24, or $49 for all three. There is no done-for-you repair.