SaaS founders: the one security check that fits in a lunch break
Founders inherit every shortcut AI tooling offered. One free scan tells you if any involved your keys. No account.
You wore PM, engineer, and ops hats this week; security got the leftovers. This page spends your ten minutes where AI-era startups actually bleed.
Your stack, your exposures
The typical founder stack concentrates every risk class at once: an AI-built frontend over a BaaS backend, payments wired fast, LLM features bolted on, email via API. Each integration arrived with a key, and each key had one safe home — almost always server-side.
The three leaks we keep finding here
The scaffold default
Starter templates wire Supabase with whichever client config makes queries return rows immediately — often service_role. Policies exist in docs, rarely in week three.
The skipped proxy
LLM features ship direct-to-provider under deadline because “we’ll add a backend later”. The bill arrives before the backend does.
The staging string
A preview build references a staging database URL client-side; the string survives merges into main quietly.
The check, time-boxed
Set aside ten minutes and run the audit yourself before trusting anyone’s dashboard, ours included:
- Open the deployed site in a browser you do not usually use, logged out.
- View source, then search the built JavaScript for
eyJ— any hit is a JWT; decode its payload and read the role claim before reacting. - Repeat for provider prefixes:
sk_live_,sk-proj-,sk-ant-,AKIA,xoxb-,SG.,whsec_. - Search for connection schemes —
postgres://,postgresql://,mongodb+srv://— and for-----BEGIN PRIVATE KEY-----. - For every hit, classify: public-by-design (anon keys, publishable keys, Firebase web keys) or genuinely secret. Only the second category is an incident.
That routine works, with two caveats: it only covers what the landing page loads unless you chase route-manifest chunks yourself, and it says nothing about yesterday’s deploy. Automation exists precisely because the check decays.
After the first scan
Free tier watches your one production app daily — enough until revenue argues for hourly (Indie, $29/mo). Findings stay visible regardless of plan; visibility is never the upsell here.
Boundaries, stated plainly
KeyDrift scans deployed web artifacts — URLs and pasted bundle source. It does not scan mobile binaries, private networks, or repositories; code behind a login is covered by paste mode, and runtime-assembled keys are outside every bundle scanner’s honest reach.
The bigger picture
It helps to name the economics honestly. Fixing this class of leak costs minutes when caught at deploy time and days when caught at invoice time, because by then the credential has been harvested, validated, resold or drained — often all four. Detection latency is the entire game, which is why the monitoring half of KeyDrift exists alongside the scanning half.
How KeyDrift reports this exact finding
When KeyDrift finds this on your deployment, the report shows a masked value (first 8 and last 4 characters only), a salted fingerprint for tracking, the exact chunk filename carrying it, and a severity with written rationale. Public-by-design neighbours — anon keys, publishable keys, Firebase web constants — appear as informational context rather than noise, because knowing what should be there is what makes the real findings credible.
Manual check, step by step
A five-minute version you can run anywhere: view-source on the landing page, copy every src= script URL, fetch each and search the results for eyJ. It misses manifest-only chunks and streamed payloads — which is precisely the gap between "I checked" and "it is clean" — but it catches the loud majority and builds the pattern-recognition that makes scanner output legible.
Close the loop with monitoring
Monitoring closes the loop that one-time verification leaves open. A scheduled scan refetches everything, diffs against history, and fires only on transitions: created, regressed, resolved. Regression alerts matter most here — they fire when a previously fixed finding returns, which in agent-era codebases is less a possibility than a schedule.
What the plans change
- Free $0 — 1 project · daily scans · email alerts · findings always visible.
- Indie $29/mo — 3 projects · hourly · Slack added · 80 chunks per scan.
- Team $89/mo — 15 projects · every 15 minutes · Discord + webhooks · 150 chunks.
- Growth — from $249/mo, quoted display-only until checkout ships.
The constant across every tier: plans limit how much is watched, never what a scan found. Visibility is structural, not promotional — asserted by tests over the entitlements model itself.
Common questions
We use [BaaS] auth — covered?
Yes: anon-key patterns classify correctly; privileged-key patterns flag loudly. Both matter differently.
SOC 2 question from enterprise — where does this fit?
Evidence, not certification: scan history demonstrates process. Say exactly that in the questionnaire.
Contractor built it — who rotates?
You do, immediately post-handover; shared credentials rotate on offboarding like keys to the office.
Run a free scan at keydrift.dev/scan — paste a URL or the bundle source itself, no account. Findings arrive masked, with the exact chunk they live in.
Related
KeyDrift is an independent product and is not affiliated with, endorsed by, or sponsored by Vercel. The name is referenced descriptively.