About
The key was never in your repository
KeyDrift reads the JavaScript your app actually serves and finds the credentials that should never have left your server.
Why it exists
Prefixes like NEXT_PUBLIC_ and VITE_ substitute an environment variable’s literal value into the bundle at build time. Your .env stays correctly git-ignored, every secret scanner in CI passes, and the key still ships to every visitor who loads the page.
That failure has become common for one specific reason: AI coding tools reach for the variable that makes the feature work, and a service-role key makes the feature work. Nobody reviewing the diff sees a secret, because in the source there is only a variable name.
So KeyDrift does not read your repository. It fetches the deployed JavaScript, walks the chunks your app loads, and reports what is actually in them — while recognising the publishable keys that are supposed to be there and are not leaks.
Evidence you can check
Every finding names the chunk it came from and the byte range inside it. You can open the same file in your own browser and see it.
Live secrets are never stored
Findings keep a masked prefix and a fingerprint — enough to identify and track a key, never enough to use one. A scanner that hoards secrets has become the exposure.
No credentials, no account
The public scanner fetches assets that are already being served to the internet. The first answer costs nothing and requires nothing.
Public keys are not findings
Publishable keys have recognisable formats. Reporting them as leaks is how a scanner teaches its users to ignore it.
Part of Veristria
KeyDrift is a Veristria product
Veristria builds verification infrastructure for teams shipping software faster than they can review it. It was founded by Lars O. Horpestad, a Nordic AI figure and the author of the first published Norwegian guide to large language models.
All three Veristria products work the same way: look at what actually shipped rather than what the source intended, prove the finding, and say plainly what to change. KeyDrift applies that to the bundle you serve.
VibeGuard
Continuous RLS testing, schema-drift detection and security monitoring for Supabase backends.
usevibeguard.comFeeGuard
Real-time detection and recovery of silent fee leaks in Stripe Connect platforms.
feeguard.dev