The five-minute secret audit for vibe-coded apps
One class of failure dominates AI-built apps: secrets in the client bundle. Run the audit free — URL or paste, no account.
Vibe coding is safe to the extent that somebody verifies the result. Most verification budgets go to features; this page spends five minutes on the failure class that silently dominates: credentials in the client bundle.
Why this one check dominates
Ask what percentage of AI-built apps have a serious security flaw and you will get opinions. Ask instead what single mechanical failure recurs across them and you get a short list topped by one item: working credentials, client-side. The reasons are structural — builders without backends, prefixes that promise publication, agents chasing green previews — and they compound under deadline pressure.
The good news: unlike logic flaws, this class is mechanically detectable from outside. You do not need to understand the app; you need to read what it serves.
The audit, manually
Open the deployed site logged-out and search built JavaScript for five families:
eyJ— any JWT. Decode the payload; role claims separate anon from service_role instantly.- Provider secret prefixes:
sk_live_,rk_live_,whsec_,sk-proj-,sk-ant-,ghp_,xoxb-,SG.. - AWS shapes:
AKIA/ASIAplus 40-char base64 near AWS-y names. - Connection schemes:
postgres,mongodb+srvwith credentials embedded. - Key material markers:
-----BEGIN PRIVATE KEY-----and service-account JSON fragments.
Classify before panicking
- Public-by-design: Supabase anon/publishable, Stripe pk_, Firebase AIza — expected in browsers; verify restrictions instead of rotating on sight.
- Genuinely secret: everything else above — treat as an incident; rotate first.
The audit, automated
keydrift.dev/scan performs the same families against the full served surface — HTML, manifest-reachable chunks, streamed payloads — and classifies dispositions automatically. Paste-source mode covers anything behind login. Reports are shareable; pasted ones stay unindexed.
If something appears
- Rotate the credential (provider paths in the incident pages).
- Move consumption server-side per the matching fix guide.
- Re-scan to verify, then enable monitoring — reintroduction is the statistically likely sequel.
What this audit does not cover
No bundle scanner parses JavaScript: runtime-assembled keys evade all of us. Mobile binaries, private networks and repositories are different surfaces needing different tools — claimed plainly so you can plan honestly.
The bigger picture
It helps to name the economics honestly. Fixing this class of leak costs minutes when caught at deploy time and days when caught at invoice time, because by then the credential has been harvested, validated, resold or drained — often all four. Detection latency is the entire game, which is why the monitoring half of KeyDrift exists alongside the scanning half.
How KeyDrift reports this exact finding
When KeyDrift finds this on your deployment, the report shows a masked value (first 8 and last 4 characters only), a salted fingerprint for tracking, the exact chunk filename carrying it, and a severity with written rationale. Public-by-design neighbours — anon keys, publishable keys, Firebase web constants — appear as informational context rather than noise, because knowing what should be there is what makes the real findings credible.
Manual check, step by step
A five-minute version you can run anywhere: view-source on the landing page, copy every src= script URL, fetch each and search the results for eyJ. It misses manifest-only chunks and streamed payloads — which is precisely the gap between "I checked" and "it is clean" — but it catches the loud majority and builds the pattern-recognition that makes scanner output legible.
Close the loop with monitoring
Monitoring closes the loop that one-time verification leaves open. A scheduled scan refetches everything, diffs against history, and fires only on transitions: created, regressed, resolved. Regression alerts matter most here — they fire when a previously fixed finding returns, which in agent-era codebases is less a possibility than a schedule.
What the plans change
- Free $0 — 1 project · daily scans · email alerts · findings always visible.
- Indie $29/mo — 3 projects · hourly · Slack added · 80 chunks per scan.
- Team $89/mo — 15 projects · every 15 minutes · Discord + webhooks · 150 chunks.
- Growth — from $249/mo, quoted display-only until checkout ships.
The constant across every tier: plans limit how much is watched, never what a scan found. Visibility is structural, not promotional — asserted by tests over the entitlements model itself.
Common questions
Free means what, exactly?
URL and paste scans cost nothing, store no live values (mask plus salted fingerprint only), and require no account. Monitoring adds plans later if you want schedules.
Scan my staging too?
Yes — any reachable URL. Previews often leak first.
Run a free scan at keydrift.dev/scan — paste a URL or the bundle source itself, no account. Findings arrive masked, with the exact chunk they live in.