KeyDrift Live Keys Stored: 0 Keys, Masked Prefixes, Fingerprints
KeyDrift live keys stored: 0. The scanner reads deployed JavaScript, uses masked prefixes and fingerprints, and alerts only when the build changes.
KeyDrift scans deployed JavaScript for leaked secrets without storing a single live key. It uses masked prefixes and fingerprints to alert you only when the build changes. You can run a free scan at keydrift.dev with no account required.
Zero Live Keys Stored, Ever
The system processes your public assets and discards raw values immediately. Zero live keys are stored, ever. The pipeline fetches only deployed public assets and issues GET requests only. It never archives secrets in a database or on disk. The architecture verifies presence and moves on. You get visibility without creating a new liability. The design assumes that holding secrets is the problem, not the solution.
Findings Use Masked Prefixes and Fingerprints
When the scanner identifies a credential, it strips the sensitive portion. Findings carry a masked prefix and a fingerprint. The prefix reveals the provider and key type. The fingerprint is a deterministic hash that tracks the exact string across deployments. You can verify a leak without ever seeing the full secret in the dashboard. This design prevents accidental exposure during triage. It also means the alerting system never handles plaintext material after the initial fetch.
KeyDrift Reads Deployed JavaScript, Not Your Repo
Repository scanners look at source control. KeyDrift looks at what actually ships. The tool reads the JavaScript your deployed app actually serves. It targets the final bundle that hits the browser. Source control is a snapshot of intent. The deployed bundle is the reality. By targeting the live endpoint, the scanner bypasses local environment variables and build caches. It evaluates the exact payload your visitors receive. The scanner fetches the exact files served to the browser. It does not guess at build outputs. It reads what the CDN actually delivers.
Build-Time Substitution Leaks Keys Repo Scanners Miss
The build is what leaks, and a repository scanner cannot see it. Modern frameworks inject environment variables during compilation. Prefixes like NEXT_PUBLIC_ and VITE_ substitute the literal value into the bundle at build time. Your .env file is correctly git-ignored. The key still ships to every visitor. Nothing is wrong in the repository. That is exactly why repo scanning reports nothing. The scanner must evaluate the compiled output to catch this pattern. The compilation step replaces variable references with hardcoded strings. The final bundle contains the raw credential. The scanner parses the minified output to locate these injected values.
Detecting Supabase, Stripe, OpenAI, and AWS Secrets
Not all exposed strings are dangerous. The scanner focuses on credentials that should never have left your server. It finds the Supabase, Stripe, OpenAI and AWS keys that belong in backend processes. These providers issue server-side tokens with elevated permissions. When those tokens end up in client-side bundles, they become public. The detection logic matches known provider signatures and validates their placement in the frontend payload. It ignores framework artifacts and focuses on backend tokens that grant direct resource access.
Filtering Anon and Publishable Keys to Stop Noise
Generic regex scanners flag everything that looks like a key. They catch the anon key and the Stripe publishable key. Those credentials are supposed to be there. Teams eventually tune the whole tool out to stop the noise. KeyDrift separates intended public tokens from leaked server secrets. It ignores credentials designed for browser execution. This keeps the alert queue clean. Engineers only investigate findings that represent actual misconfigurations. The system understands the difference between a client-side identifier and a server-side secret.
Re-Scanning on Every Push and Alerting on Change
Static scans create stale reports. KeyDrift re-scans on every push and alerts only when something actually changes. The system compares the new fingerprint against the previous baseline. If the bundle shifts, the scanner runs again. It tracks the exact moment a secret enters the public payload. You receive a notification tied to a specific deployment. This eliminates guesswork about when the leak occurred. It also prevents duplicate alerts for unchanged bundles. The workflow integrates into your release cycle without adding manual verification steps.
Free Scans, One-Time Payments, and No Withheld Findings
Verification should not require a contract. A free scan at keydrift.dev requires no account. Give it a URL or paste a bundle directly. The public scan is free, and the free tier keeps 1 project on daily scans with email alerts. Monitoring is Indie at $19 per 30 days (3 applications, hourly scans, email and Slack, up to 80 chunks per scan) or Team at $39 per 30 days (15 applications, 15-minute scans, email, Slack, Discord and webhooks, up to 150 chunks). Payment is one-time through Revolut Pro, includes 30 days, and does not auto-renew. Findings are never withheld on any plan. You get the full report regardless of tier.
Run a free scan at keydrift.dev with no account required.