Monitor production sites for newly exposed keys

Scheduled scans with drift alerts: new, regressed, or resolved findings only — no noise. Free tier monitors one project daily.

2026-08-233 min read

Deploys keep happening after you close the dashboard. Monitoring exists for everything that happens next.

How the loop works

Add a project (URL) in the dashboard; pick a schedule your plan allows.
Each run fetches the deployment fully — chunks via manifests, streamed payloads included.
Findings diff against history: created / regressed / resolved transitions computed.
Transitions fan out to destinations with per-channel severity thresholds.

Partial scans never resolve findings — absence must mean verified-clean, not fetch-failure. Replays emit nothing twice thanks to dedup on destination+fingerprint+kind+timestamp.

What alerts contain

{
  "kind": "regressed",
  "severity": "critical",
  "leaked_key_type": "supabase-jwt",
  "leaked_key_label": "Supabase service_role key",
  "masked_value": "eyJhbGci…2_BE",
  "key_fingerprint": "…",
  "bundle_chunk_filename": "/_next/static/chunks/app/page.js",
  "scanned_url": "https://app.example.com/",
  "occurred_at": "2026-08-23T09:00:00.000Z"
}

Flat, snake_cased, parseable anywhere. No live secret ever existed outside the engine to include — masks only.

Plans mapped to needs

Free — 1 project, daily scans, email alerts, 40 chunks per scan.
Indie $29/mo — 3 projects, hourly, +Slack, 80 chunks.
Team $89/mo — 15 projects, 15-minute cadence, +Discord/webhooks, 150 chunks.
Growth — from $249/mo, display-only while checkout ships.

Every plan sees every finding. Plans gate watching, never truth — a principle tested into the entitlements model itself.

Boundaries

Behind-login surfaces need paste mode; private networks and mobile binaries remain out of scope by design. Stated plainly so procurement hears honesty instead of asterisks.

Why this failure class persists

It helps to name the economics honestly. Fixing this class of leak costs minutes when caught at deploy time and days when caught at invoice time, because by then the credential has been harvested, validated, resold or drained — often all four. Detection latency is the entire game, which is why the monitoring half of KeyDrift exists alongside the scanning half.

How KeyDrift reports this exact finding

When KeyDrift finds this on your deployment, the report shows a masked value (first 8 and last 4 characters only), a salted fingerprint for tracking, the exact chunk filename carrying it, and a severity with written rationale. Public-by-design neighbours — anon keys, publishable keys, Firebase web constants — appear as informational context rather than noise, because knowing what should be there is what makes the real findings credible.

Manual check, step by step

A five-minute version you can run anywhere: view-source on the landing page, copy every src= script URL, fetch each and search the results for eyJ. It misses manifest-only chunks and streamed payloads — which is precisely the gap between "I checked" and "it is clean" — but it catches the loud majority and builds the pattern-recognition that makes scanner output legible.

Close the loop with monitoring

Monitoring closes the loop that one-time verification leaves open. A scheduled scan refetches everything, diffs against history, and fires only on transitions: created, regressed, resolved. Regression alerts matter most here — they fire when a previously fixed finding returns, which in agent-era codebases is less a possibility than a schedule.

What the plans change

Free $0 — 1 project · daily scans · email alerts · findings always visible.
Indie $29/mo — 3 projects · hourly · Slack added · 80 chunks per scan.
Team $89/mo — 15 projects · every 15 minutes · Discord + webhooks · 150 chunks.
Growth — from $249/mo, quoted display-only until checkout ships.

The constant across every tier: plans limit how much is watched, never what a scan found. Visibility is structural, not promotional — asserted by tests over the entitlements model itself.

Common questions

Alert fatigue?

Transitions-only plus thresholds: state changes alert, steady states never.

Multiple apps?

Team plan covers fifteen projects — agencies/previews map naturally onto it.

Run a free scan at keydrift.dev/scan — paste a URL or the bundle source itself, no account. Findings arrive masked, with the exact chunk they live in.