Free security scan for AI-generated web apps
Free scan of any deployed web app for exposed API keys — 21 detectors, masked findings, shareable report. No account needed.
This is the offer page, stated plainly: KeyDrift scans any deployed web application for exposed API keys and secrets, free, without an account. Here is exactly what happens and what you get.
What happens when you submit
- The scanner fetches your URL the way a browser would — following sibling asset hosts, honoring tenant boundaries on shared platforms.
- It collects the HTML, every discoverable JavaScript chunk (including route-manifest-only ones), and streamed server data.
- Twenty-one detectors run: provider prefixes, structural matches (JWT, PEM), and entropy-with-context for unknowns.
- Findings classify: secret vs public-by-design, severity, confidence. Below-threshold noise is dropped, not shown.
What the report shows
- Masked value (first 8 / last 4) and salted fingerprint — never the live string.
- Exact chunk filename and scanned URL, so remediation starts immediately.
- Severity with rationale, plus a link to the matching fix guide.
Privacy model, in four lines
- GET/HEAD only, enforced in the fetch layer — the scanner cannot write.
- SSRF-hardened: private ranges and cloud metadata refused pre-socket and per redirect.
- No live secret ever leaves the detection engine; storage physically lacks a column for one.
- Paste-source reports are noindexed; your private code does not become marketing.
Then what?
Clean reports make good baseline evidence; findings come with runbooks ordered rotate-first. If schedules beat memories, monitoring starts free for one project and scales from $29/month — visibility never gated.
The bigger picture
Zoom out and the pattern is bigger than one repo. AI-assisted output has outgrown review capacity everywhere at once, which means thousands of teams are making the same reasonable-looking tradeoffs in the same week. Nobody using modern tooling is uniquely exposed. The failure mode documented above is the modal outcome of velocity without verification, not evidence of carelessness.
How KeyDrift reports this exact finding
Report anatomy matters during incidents, so it is worth reading once calmly: masked string (never the live value — it ceases to exist outside the detection engine), salted fingerprint (trackable within your workspace, useless to strangers), chunk path (your starting point for a "git log -S" hunt), disposition (secret versus public-by-design), confidence (matches below 0.5 never reach the page at all).
Manual check, step by step
The full manual drill, for readers who want zero dependence on any tool: open the deployed site in a private window; launch DevTools → Sources; use Search-all-files (Ctrl/Cmd+Shift+F) for eyJ; then repeat for the other marker families — eyJ, sk_live_, sk-proj-, AKIA, postgres, BEGIN PRIVATE KEY. Decode anything JWT-shaped before reacting, and classify public-by-design formats as expected guests rather than intruders.
Close the loop with monitoring
If you take one operational step from this page, make it this: put the URL under continuous monitoring (free tier covers one project daily). The first scan tells you whether you have a problem today; the schedule tells you whether the problem comes back next month after someone re-adds the convenient line.
What the plans change
- Free $0 — 1 project · daily scans · email alerts · findings always visible.
- Indie $29/mo — 3 projects · hourly · Slack added · 80 chunks per scan.
- Team $89/mo — 15 projects · every 15 minutes · Discord + webhooks · 150 chunks.
- Growth — from $249/mo, quoted display-only until checkout ships.
The constant across every tier: plans limit how much is watched, never what a scan found. Visibility is structural, not promotional — asserted by tests over the entitlements model itself.
Common questions
Can I scan localhost?
Private addresses are refused by design; deploy or tunnel a public URL first.
Report language for clients?
Shareable link plus PDF-friendly print — written to hand to non-engineers without translation.
Run a free scan at keydrift.dev/scan — paste a URL or the bundle source itself, no account. Findings arrive masked, with the exact chunk they live in.