Is your AI-built app leaking keys?
Paste your app's address. In about 20 seconds you'll see if your API keys, database keys or .env file are visible to anyone, and get the exact prompt to fix each problem in Lovable, Cursor or Claude.
Free. No sign-up. We only look at what any visitor's browser can already see, and we don't save the results.
What it checks
- Secret keys in your site's code: OpenAI, Anthropic, Stripe, Supabase service keys, AWS, GitHub tokens and private keys that ended up in the JavaScript every visitor downloads.
- Files that should never be public:
.env,.env.local,.env.productionand the.gitfolder. - HTTPS: whether your site is encrypted and whether insecure visitors get moved to the secure version.
- Browser safety settings: the security headers that stop clickjacking and other common attacks.
- Supabase: if your app uses it, a reminder and a test for Row Level Security, the most common real leak in AI-built apps.
What it never does
- It never logs in, fills in forms, guesses passwords or tries to break anything. It makes at most 14 ordinary page requests.
- It never shows or keeps a full key. Anything it finds is cut short, like
sk-proj-…, and nothing is stored. - It only checks public web addresses, never private or internal ones.
A good score doesn't mean an app is fully secure: this is a quick check for the most common mistakes, not a full security review. Please only check apps you own or have permission to test.