# KeyDrift

> Finds API keys and secrets that AI coding tools leave in client-side JavaScript bundles.
> 21 secret detectors across 13 providers, plus 3 public credential formats recognised specifically so they are *not* reported as leaks.

## What it does
- Free scan, no account: paste a URL, get a redacted report — https://keydrift.dev/scan
- Continuous monitoring: re-scans on every deploy and alerts on new, regressed and resolved keys
- Pricing: $19/mo Indie · $39/mo Team

## What makes it different
- Scans the deployed bundle, not the repository. A key that never touched git still ships to the browser.
- Distinguishes credentials that belong in a browser from ones that do not. A Supabase anon key, a Stripe publishable key and a Firebase web API key are recognised and excluded rather than reported.
- Rejects documented sample keys. Stripe's `sk_test_4eC39…` and the AWS guide's `AKIAIOSFODNN7EXAMPLE` match their formats perfectly and are worth nothing.
- Never stores a live key. Findings carry a masked prefix and a salted fingerprint.

## Detection rules
- Supabase JWT (critical) → https://keydrift.dev/docs/rules/supabase-jwt
- Supabase secret key (critical) → https://keydrift.dev/docs/rules/supabase-secret-key
- Supabase personal access token (critical) → https://keydrift.dev/docs/rules/supabase-access-token
- Stripe secret key (critical) → https://keydrift.dev/docs/rules/stripe-secret-key
- Stripe restricted key (high) → https://keydrift.dev/docs/rules/stripe-restricted-key
- Webhook signing secret (high) → https://keydrift.dev/docs/rules/stripe-webhook-secret
- OpenAI API key (critical) → https://keydrift.dev/docs/rules/openai-api-key
- OpenAI-compatible API key (critical) → https://keydrift.dev/docs/rules/openai-legacy-key
- Anthropic API key (critical) → https://keydrift.dev/docs/rules/anthropic-api-key
- AWS access key ID (critical) → https://keydrift.dev/docs/rules/aws-access-key-id
- AWS secret access key (critical) → https://keydrift.dev/docs/rules/aws-secret-access-key
- GitHub token (critical) → https://keydrift.dev/docs/rules/github-token
- GitHub fine-grained token (critical) → https://keydrift.dev/docs/rules/github-fine-grained-token
- Resend API key (high) → https://keydrift.dev/docs/rules/resend-api-key
- SendGrid API key (high) → https://keydrift.dev/docs/rules/sendgrid-api-key
- Slack token (high) → https://keydrift.dev/docs/rules/slack-token
- Mapbox secret token (high) → https://keydrift.dev/docs/rules/mapbox-secret-token
- Postgres connection string (critical) → https://keydrift.dev/docs/rules/postgres-connection-string
- MongoDB connection string (critical) → https://keydrift.dev/docs/rules/mongodb-connection-string
- Private key (critical) → https://keydrift.dev/docs/rules/private-key-pem
- Credential-shaped value in a client bundle (medium) → https://keydrift.dev/docs/rules/generic-high-entropy

## Recognised as public, never reported as a leak
- Supabase publishable key → https://keydrift.dev/docs/rules/supabase-publishable-key
- Stripe publishable key → https://keydrift.dev/docs/rules/stripe-publishable-key
- Google API key → https://keydrift.dev/docs/rules/google-api-key

## Fix guides
10 credential types × 6 tools at https://keydrift.dev/fix
- Lovable: https://keydrift.dev/fix?tool=lovable
- Bolt.new: https://keydrift.dev/fix?tool=bolt
- Cursor: https://keydrift.dev/fix?tool=cursor
- Claude Code: https://keydrift.dev/fix?tool=claude-code
- Replit: https://keydrift.dev/fix?tool=replit
- Next.js: https://keydrift.dev/fix?tool=nextjs

## API
- Scan a URL: POST https://keydrift.dev/api/v1/scan/public {"url": "https://example.com"}
- Scan pasted source: POST https://keydrift.dev/api/v1/scan/source {"source": "…"}
- Read a report: GET https://keydrift.dev/api/v1/reports/{id}

## Limits, stated plainly
- Detection is regex, entropy and surrounding context. There is no JavaScript parser, so a key assembled at runtime from concatenated fragments is not found.
- A scan reads what a browser would download. It does not authenticate, and it cannot see code behind a login.
- "No findings" on a partial scan is reported as partial, never as clean.

## More
- Full context: https://keydrift.dev/llms-full.txt
- How the scanner works: https://keydrift.dev/docs/scanner