KeyDrift: Build leaks repository scanners miss
NEXT_PUBLIC_ and VITE_ inline secrets at build time. Repo scanners miss them; KeyDrift finds them in deployed JavaScript. Free scan at keydrift.dev.
NEXT_PUBLIC_ and VITE_ prefixes substitute the literal value into the bundle at build time. The .env file is git-ignored, but the key still ships to every visitor. Repo scanners see nothing, because nothing is wrong in the repository.
Why repo scanners miss NEXT_PUBLIC_ and VITE_ leaks
The build is what leaks. NEXT_PUBLIC_ and VITE_ embed the secret directly into the JavaScript bundle. The repository scanner looks at the code you commit, not the code you deploy. Generic regex scanners flag the Supabase anon key and the Stripe publishable key—credentials that are supposed to be there—until the team tunes the tool out.
The tool-shaped leak: Lovable, Bolt, Cursor, Next.js
The leak is tool-shaped. Lovable and Bolt build Vite SPAs with no server to put a key on. Cursor edits the file you have open rather than the architecture. In Next.js, the quickest fix for a build error is the NEXT_PUBLIC_ rename that inlines the secret.
21 detectors, 3 public formats ignored on purpose
KeyDrift runs 21 secret detectors. It also recognises and excludes 3 public credential formats on purpose: the Supabase anon key, the Stripe publishable key, and the Firebase web key. Knowing that these are meant to be there is what lets KeyDrift say with confidence that the JWT sitting next to them is a service_role key.
No live keys stored—masked findings, fingerprints only
KeyDrift never stores a live key. Findings carry a masked prefix and a fingerprint. It re-scans on every push and alerts only when something actually changes.
Free scan at keydrift.dev: URL or paste a bundle
Run a free scan at keydrift.dev—no account. Give it a URL or paste a bundle directly. It fetches only deployed public assets, issues GET requests only, and never stores a live key.
Monitoring plans: Indie, Team, no auto-renew
The public scan is free, and the free tier keeps 1 project on daily scans with email alerts. Monitoring is Indie at $19 per 30 days (3 applications, hourly scans, email and Slack, up to 80 chunks per scan) or Team at $39 per 30 days (15 applications, 15-minute scans, email, Slack, Discord and webhooks, up to 150 chunks). One-time payment through Revolut Pro, includes 30 days, does not auto-renew. Findings are never withheld on any plan.
Run a free scan at keydrift.dev — no account, no storage of live keys.