KeyDrift Free Scan: Find Leaked Secrets in Deployed JS Bundles
Run a free KeyDrift scan at keydrift.dev to find server-side API keys leaked to client-side JS bundles. No account required, no live key values stored.
KeyDrift’s free scan at keydrift.dev requires no account. Paste a deployed app URL or upload a production JavaScript bundle to start.
The scan only fetches publicly deployed assets via GET and HEAD requests. It never stores the real value of any live secret it finds: all findings include only a masked key prefix and a unique fingerprint. Each scan is saved to its own shareable report link; treat that link with the same care as the bundle it was generated from.
Build-time leaks are invisible to repository scanners. Prefixes like NEXT_PUBLIC_ and VITE_ substitute literal secret values into your JavaScript bundle at build time, so your .env file stays correctly git-ignored while the key ships to every visitor. Nothing is wrong in your repository, which is exactly why repo scanning reports no issues. Generic regex scanners often flag public-by-design credentials like the Supabase anon key or Stripe publishable key, leading teams to tune the tool out entirely.
KeyDrift uses 24 purpose-built secret detectors, and explicitly recognizes 4 public-by-design credential formats to avoid false positives: the Supabase anon and authenticated keys, the newer sb_publishable_ key, the Stripe publishable key, and the Google/Firebase web key are all meant to be present in client-side code. This lets KeyDrift confidently flag the high-risk secrets sitting alongside them, like Supabase service_role keys, Stripe secret keys, OpenAI API keys, and AWS credentials.
No live key values are ever stored, regardless of plan. KeyDrift re-scans your deployed assets on a schedule — daily for free tier users, hourly for Indie plans, or every 15 minutes for Team plans — and only sends alerts when a finding changes.
The leak is often tool-shaped: AI coding tools like Lovable and Bolt build Vite SPAs with no server to hold secrets, Cursor edits the file you have open rather than your app’s architecture, and in Next.js the quickest fix for a build error is renaming a secret to NEXT_PUBLIC_ which inlines it directly into the bundle.
Run a free scan of your deployed app at keydrift.dev — no account required, just paste a URL or upload your production bundle.