Documentation
Everything KeyDrift documents about itself, in one place: what it detects, how it decides, what it refuses to do, and how to fix or watch what it finds.
Start here
- Detection rulesEvery credential format KeyDrift recognises, secret and public, generated from the rule catalog.
- How the scanner worksWhat gets fetched, how a match becomes a finding, and what the engine refuses to do.
- The field manualA free, no-account handbook on where secrets escape and how to close the gap.
- Fix guidesThe exact code change, crossed by tool and credential — Lovable, Bolt, Cursor, Claude Code, Replit, Next.js.
- Continuous monitoringScheduled re-scans that alert only on findings that are created, regressed, or resolved.
Support documentation
51 articles, generated from the same manifest that publishes them — nothing listed below can be a dead link without also disappearing from this index.
Getting started
What KeyDrift is, how to run a first scan, and how to read what it finds.
- Reading a reportField-by-field tour: label, provider, severity, confidence, mask, fingerprint, chunk path — and what to do next for each.
- Scanning a live URLEnter any deployed URL; KeyDrift fetches HTML, chunks (incl. manifest-only), and streamed payloads, then classifies findings.
- Scanning code behind a loginPaste bundle source for authenticated-only surfaces; reports stay noindexed because nobody else can fetch what you pasted.
- Severity, confidence, dispositionsThree orthogonal axes explained with worked examples — why calibration beats maximisation.
- From one scan to monitoringMagic-link account, add projects, pick schedule; drift alerts fire only on transitions. Free tier covers one project daily.
- What KeyDrift isKeyDrift finds API keys and secrets that AI coding tools leave in client-side JavaScript bundles — free URL or paste scan.
How the scanner works, in depth
The pipeline, entropy scoring, sample-key exclusion, JWT handling, and the other mechanisms behind a finding.
- Exactly-once delivery semanticsDedup key anatomy and replay behaviour: one transition delivers once regardless of retries or rescans.
- Finding every file worth readingLanding-page-only crawls miss the code calling paid APIs. Manifests, preload hints, and hydration payloads included.
- From raw match to reported findingFour gates: placeholders → entropy → refinement → context. Below 0.5 confidence: dropped silently.
- Drift: created / regressed / resolvedSnapshots become transitions. Only transitions alert. Partial scans resolve nothing; replays emit nothing twice.
- Measuring randomness properly`sk_live_000…0` matches Stripe’s rule perfectly. Body-normalised entropy is why it never becomes a finding.
- GET-only, SSRF-hardened fetchingMethods restricted at layer level; private ranges refused pre-socket and per redirect; errors render fixed phrases.
- Anatomy of a detectorRule fields walked through: lookaround conventions, dispositions, refine hooks, revokeUrls — generated docs guarantee coverage.
- Decoding without verifying, on purposeSignature verification asks if a token is valid. We ask what it claims — role/expiry decide classification.
- The scanning pipeline end to endResolve → fetch → discover chunks → extract → placeholder filter → entropy → refine → threshold → persist mask+fingerprint → diff → notify.
- Credentials that belong in browsersAnon/publishable/Firebase-web keys recognised deliberately — exclusion is what makes secret detection credible.
- How detection changes are testedSynthetic fixtures shaped like real credentials (none ever live); contract tests across stores; catalog-docs-sitemap consistency asserted.
- Documented examples rejected by nameStripe’s demo key and AWS’s EXAMPLE id live in tutorials and training data. Reporting them is the costliest mistake available.
- When two providers share a shapeClerk issues secret keys identical to Stripe’s. Context decides attribution; uncertainty reported honestly as “Stripe or Clerk”.
- Asset hosts and tenant carve-outsSame-site following catches frontend-assets-style hosts; shared-platform tenants (*.vercel.app etc.) never cross.
- Streamed server data in HTMLNext.js self.__next_f.push and Nuxt window.__NUXT__ carry server values client-side; secrets handed to client components land here.
- Honest boundariesRuntime-assembled keys, authenticated surfaces, mobile/native targets: stated plainly because overselling helps nobody.
Alerting
Slack, Discord, and raw webhooks — destinations, retries, and the payload each one carries.
- Retry and drop classificationTransient 5xx retry with backoff; definitive 404 drops. Retrying deleted webhooks forever poisons queues.
- Setting up alert destinationsEmail default; Slack from Indie; Discord/webhooks Team. Save-time validation catches typos; thresholds per destination.
- Discord setup guideChannel integrations webhook → paste → threshold → save/test. Arrives at Team plan.
- Event kinds: created, regressed, resolvedRegression alerts explicitly distinguish comeback-from-fixed versus first appearance — different meaning, different response.
- Outbound payload referenceNine flat snake_cased fields; masking guaranteed; consumer guidance keyed on dedup quadruple.
- Slack setup guideIncoming-webhook URL, threshold choice, save-time validation, synthetic test procedure.
- Raw webhook setup & validationPOST full JSON anywhere; SSRF-checked at save and re-resolved at send. Dedup quadruple documented for consumers.
Monitoring
Projects, schedules, the findings lifecycle, and what happens when billing lapses.
- Open, resolved, regressedState machine: open until a COMPLETE clean scan resolves; reconciliation row-locks prevent duplicate emissions.
- Billing states and continuitypast_due keeps watching (cards retry during vacations); canceled/unpaid/paused downgrade. Downgrades stop delivery channels, never visibility.
- Projects and workspacesPlan limits apply at add-time (“The free plan monitors one project.”); naming conventions age well.
- Schedules and intervalsdaily/hourly/15-min mapped to plans; interval × chunk-budget interplay; missed-scan behaviour documented.
Interfaces — CLI, API, reports
Running KeyDrift from a terminal, over HTTP, or sharing a report link.
- CLI referencekeydrift <url> [--fail-on sev] [--json]; exit 0 clean / 1 findings / 2 could-not-scan — conflation is why tools die.
- HTTP API v1POST /api/v1/scan/public · POST /api/v1/scan/source · GET /api/v1/reports/[id]. JSON in/out; fixed error phrases; rate-limited per instance.
- Sharing and embedding reportsURL scans produce shareable, indexable reports; paste-source stays noindexed. Canonical URLs stable per id.
Plans and billing
What each plan watches, what changes on upgrade or downgrade, and what never changes: findings are never withheld.
- The visibility promisePlans limit watching, never seeing. “1 critical finding — upgrade to see” is ransomware-shaped and absent by construction.
- Plans, limits, entitlementsFree $0 · Indie $29 · Team $89 · Growth from $249 display-only. Limits bind watching; visibility never gated.
- Changing plansUpgrades apply immediately; downgrades stop delivery channels, not visibility; checkout currently shows launch-notify while a rail connects.
Security and privacy
What's fetched, what's stored, what's never stored, and how to report a vulnerability.
- What we fetch, store, never storeFetched: public artifacts. Stored: masks/fingerprints/filenames/URLs/timestamps. Never stored: live secret values — nowhere to put them.
- Security model overviewThreat model: we handle other people’s secrets’ metadata. Controls: masks+salted fingerprints, GET-only, SSRF-hardening, double webhook checks, magic-link auth.
- Why findings can’t leak your keysUnsalted hashes turn findings tables into yes/no oracles for known keys. Salting breaks the oracle; tests enforce absence of live values.
- Reporting a vulnerabilityEmail security@teamveristria.com; acknowledge-first posture; safe-harbour tone; no bounty program today — stated honestly.
Troubleshooting
Network error phrases explained, reporting a false positive or a miss, and what to check before you trust a clean scan.
- Network error phrases explainedEach fixed phrase glossed to root cause (DNS/refused/blocked-range/TLS) without exposing internals.
- Reporting a false positive or missEmail with rule id + MASKED value only (never real keys); triage flow feeds fixtures; contribution invited.
- Scan says clean but I suspect a leakChecklist: right hostname? Behind login? Runtime assembly? Preview vs prod? Then manual five-search fallback — boundaries honored.
- Scanning code behind a loginPaste-mode workflow: export built JS from DevTools for authed views; rotate-before-paste if exposure suspected; reports stay private.
- SPA chunks reported missingPartial-scan semantics explained; client-side routing hides chunks from naive crawls; retry guidance.
FAQ, glossary, changelog
Short, quotable answers, the terms this site uses precisely, and what changed recently.
- ChangelogDetection/platform changes dated newest-first; generated alongside catalog releases.
- Master FAQEighteen questions answered in ≤3 sentences each — scannable, quotable, honest.
- GlossaryBundle, chunk, disposition, drift, fingerprint, mask, regression, sibling host, tenant suffix, hydration payload, service_role, publishable key, source map, SSRF.
Run one check now
Every page in this index ends the same way, because there is only one honest way to know what a deployment serves: fetch it and look. The scan is free, needs no account, and takes about as long as reading this sentence.