Ways to find leaked keys, compared honestly

Before comparing products, it helps to be precise about what any of them can physically see. Credentials exist in four places, and the four families of tooling map onto them cleanly:

• Source — what is committed. Guarded by pre-commit hooks, push protection and repo scanners.
• Pipeline — what moves through CI. Guarded by pipeline scans and policy gates.
• Configuration — where secrets live at rest. Guarded by vaults, secret managers and cloud posture tools.
• The deployed artifact — what browsers actually download. This page's subject, and KeyDrift's entire scope.

Most teams are covered on the first three and uncovered on the fourth, for a structural reason rather than a negligence one: the fourth file set does not exist until after the other tools finish. A bundler substitutes NEXT_PUBLIC_ values during build; an agent writes a client-side call during a feature branch; a hydration payload serialises whatever a loader returned. None of that passes through git as a secret, so none of it can appear in a repository scan — including a clean one run minutes before deploy.

The pages here hold the comparisons stated as mechanics rather than marketing. Each follows the same discipline: define both approaches precisely, credit where each genuinely wins, name where each is structurally blind, then give the combination that works and an if/then decision rule you can apply without reading anything else. Where a claim could not be verified, the page says so instead of rounding it into existence.

One warning applies to every comparison including our own: no single layer watches all four places. Anyone selling total coverage is describing their roadmap in the past tense. The mature setup layers a source-side guard, a config-side store, and a deployed-artifact check that runs on a schedule — which is why most of these pages end with "use both" rather than "switch".