Paste your code or .env, point it at your live site, or drop in a public GitHub repo. We'll look for API keys that shouldn't be there and tell you exactly what to do about each one! Free, no signup.
🔒 Runs 100% in your browser, nothing is uploaded. What you paste and what gets scanned never reaches us, and we don't log anything. Exactly what gets fetched ↓
.env will flag everything in it. That's expected. The real question is whether those values ever reach the browser or git.Your browser downloads the page and the same-origin JavaScript files it loads (up to 40), then scans them right here. Many sites block this with CORS. If that happens, we'll tell you and you can paste the JS instead.
Public repos only, default branch only, up to 200 text files. Uses GitHub's free public API, which allows about 60 requests an hour per IP. A scan uses 2.
VibeShip Daily is a free newsletter about AI and vibe coding for people who ship: 3 short issues a week (Mon/Wed/Fri), every claim sourced, plus a Fix of the Week for exactly this kind of problem.
Form not working? Subscribe here · Unsubscribe anytime. We never sell your email.
Found something and not sure how to fix it? That's what ShipIt is for (coming soon): an automated preflight scan, then fixed-price fixes delivered as a pull request.
Paste: nothing is fetched at all. The text is scanned by JavaScript on this page.
Live site URL: your browser sends a normal GET request to the URL you typed, reads the HTML, finds <script src> and modulepreload files on the same origin, plus JS chunk paths mentioned inside those files, and downloads up to 40 of them. Requests go straight from your browser to that site, not through us. Browsers only let a page read another site's response if that site sends an Access-Control-Allow-Origin header (CORS). Most sites don't, so for many URLs the scan can't read anything. That's the browser protecting you, not a bug. Workaround: open your site, open DevTools → Sources (or view-source), copy the JS and paste it in the first tab.
GitHub repo: your browser calls api.github.com twice without logging in (repo info, then the file list for the default branch), then downloads up to 200 text files (common code/config extensions, plus files with no extension) under 512 KB from raw.githubusercontent.com. GitHub sees your IP like any visit to GitHub. Unauthenticated API calls are limited to about 60 per hour per IP. If you hit the limit we'll say when it resets.
Rules adapted from a subset of the open-source gitleaks default rules: AWS access keys and secret keys, OpenAI and Anthropic API keys, Stripe secret and restricted keys, GitHub tokens, Google API keys (also used by Firebase), Firebase Cloud Messaging server keys, Supabase service_role keys, Slack tokens and webhooks, private keys (PEM), and generic high-entropy values assigned to names like secret, token or password.
A clean result means we found no known patterns. It does not mean your app is safe. We can miss secrets that don't match a pattern, keys split across strings, anything in git history, server-side code we can't see, and leaks like Supabase tables without Row Level Security. Some findings will be false positives (test keys, examples, public-by-design keys). Every value we show is masked to its first 4 characters plus ****.