KeyLeak Detector
A free scanner that catches a mistake almost every web team makes eventually: accidentally leaving a real API key or database password visible in a website's code where anyone can copy it.
🔗 Visit KeyLeak Detector
Description
It's surprisingly common for a secret key — for OpenAI, Stripe, AWS, a database — to end up exposed in a website's public JavaScript files, HTTP headers, or API responses, usually by accident during development. KeyLeak Detector scans a live site the way an attacker would: it crawls pages, inspects JS bundles, network traffic, and headers, and checks whether any exposed key is actually still active, rather than just pattern-matching text and guessing.
It supports live validation across 14+ providers (OpenAI, Anthropic, Gemini, Stripe, GitHub, AWS, and more), checks Supabase and Firebase projects specifically for missing Row-Level Security, analyzes JWT tokens for risky permissions and expiry issues, and can discover and scan an entire site's subdomains at once. It ships as a Chrome extension, a Python CLI, and a GitHub Action, keeps false positives down with a 200+ domain allowlist, and — notably — runs entirely locally with zero data sent anywhere.
💬 Our review
The short version: this is a free, genuinely useful five-minute check for any team shipping a web app — it catches the specific, embarrassing mistake of a live API key sitting in plain sight, and it verifies the key still works instead of just flagging text that looks like one.
It sits in the same space as established secret scanners like GitLeaks and TruffleHog, but with a different angle: those scan source code and git history, while KeyLeak Detector scans the live, deployed site — catching leaks that only show up in the built JavaScript bundle, not the source repo. That makes it a complement to a code scanner rather than a replacement: run GitLeaks/TruffleHog against your repo, and KeyLeak Detector against your deployed site, and you cover both the source and the shipped artifact.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Licence MIT, traitement 100% local, aucune donnée envoyée.
Pros
Valide les clés en direct sur 14+ fournisseurs plutôt que de deviner
Détecte aussi les erreurs de configuration Supabase/Firebase (RLS)
Gratuit, 100% local, extension Chrome + CLI + GitHub Action
Cons
Ne scanne que le site déployé, pas l'historique git (complémentaire à GitLeaks/TruffleHog)
Outil de niche récent, communauté encore petite
Nécessite de comprendre les résultats JWT/RLS pour les corriger