Keydrift service_role context aware

Context-aware detection rather than dumb regex, so NEXT_PUBLIC_ noise does not bury real issues. Built for client bundles and modern frontend env conventions, targeting patterns like Supabase service_role, Stripe secrets, OpenAI/Anthropic keys, and AWS/Firebase credentials.

KeyDrift reads the JavaScript your deployed app actually

KeyDrift reads the JavaScript your deployed app actually serves and finds the Supabase, Stripe, OpenAI and AWS keys that should never have left your server.

The build is what leaks, and a repository

The build is what leaks, and a repository scanner cannot see it.

• NEXT_PUBLIC_ and VITE_ prefixes substitute the literal value into the bundle at build time, so the .env file is correctly git-ignored and the key still ships to every visitor.
• Nothing is wrong in the repository, which is exactly why repo scanning reports nothing.
• Meanwhile generic regex scanners flag the anon key and the Stripe publishable key — credentials that are supposed to be there — until the team tunes the whole tool out.

The public scan is free, and the free

The public scan is free, and the free tier keeps 1 project on daily scans with email alerts.

• Monitoring is Indie at $19 per 30 days (3 applications, hourly scans, email and Slack, up to 80 chunks per scan) or Team at $39 per 30 days (15 applications, 15-minute scans, email, Slack, Discord and webhooks, up to 150 chunks).
• One-time payment through Revolut Pro, includes 30 days, does not auto-renew.
• Findings are never withheld on any plan.

21 secret detectors, and 3 public credential formats (service_role)

21 secret detectors, and 3 public credential formats recognised and excluded on purpose — the anon key, the Stripe publishable key and the Firebase web key are meant to be there, and knowing that is what lets KeyDrift say with confidence that the JWT sitting next to them is a service_role key.

0 live keys stored, ever — findings carry

0 live keys stored, ever — findings carry a masked prefix and a fingerprint.

KeyDrift re-scans on every push and alerts only when something actually changes.

The leak is tool-shaped: Lovable and Bolt build

The leak is tool-shaped: Lovable and Bolt build Vite SPAs with no server to put a key on, Cursor edits the file you have open rather than the architecture, and in Next.js the quickest fix for a build error is the NEXT_PUBLIC_ rename that inlines the secret.

A free scan at keydrift.dev — no account (keydrift.dev)

A free scan at keydrift.dev — no account.

• Give it a URL or paste a bundle directly.
• It fetches only deployed public assets, issues GET requests only, and never stores a live key: findings carry a masked prefix and a fingerprint.