Free API Key Exposure Scanner
Exposed API keys in client-side JavaScript are one of the most common and dangerous security vulnerabilities in SaaS products. SaaSalyst scans your inline scripts and JS bundles for 12 API key patterns including OpenAI, Stripe secret keys, AWS access keys, and Supabase service role keys. The scanner uses Shannon entropy analysis to reduce false positives and differentiates between safe anon keys and dangerous service role keys.
Scan your site for exposed API keysWhy This Matters
Exposed API keys in client-side JavaScript are one of the most dangerous security vulnerabilities in SaaS. GitGuardian's 2025 report found 40% higher secret exposure in repos using AI coding assistants. Escape.tech discovered 400+ exposed secrets across just 5,600 vibe-coded apps scanned.
40%
Higher secret exposure in repos using AI coding assistants
GitGuardian 2025 Report
400+
Exposed secrets found across 5,600 vibe-coded apps
Escape.tech
What We Find
- OpenAI or Anthropic API keys hardcoded in frontend bundles, where attackers can run up your bill
- Stripe secret keys in client-side code, enabling unauthorized charges and refunds
- AWS access keys exposed in JavaScript, granting access to your cloud infrastructure
- Supabase service role key in client code, which bypasses ALL Row Level Security
- Firebase API keys without the security rules that keep your database private
Checks We Run
How to Fix It
The fastest way to identify your specific gaps is to run a full SaaSalyst scan of your site. The free scan takes 30 seconds and shows you exactly which of the 118 business readiness signals need attention. No signup required.
Run a full Business Readiness scan
Run a free scan to check your site against 118 business readiness signals.
Frequently Asked Questions
What API keys does SaaSalyst scan for?
SaaSalyst scans for 12 API key patterns: OpenAI, Anthropic, Stripe secret keys, AWS access keys, GitHub tokens, SendGrid, Resend, Firebase, and Supabase service role keys. The scanner uses Shannon entropy analysis to reduce false positives and differentiates between safe anon keys and dangerous service keys.
How do API keys end up in client-side code?
Common causes: environment variables prefixed with NEXT_PUBLIC_ or VITE_ that get bundled into client JS, AI coding assistants suggesting inline key usage, copy-pasting from documentation without understanding client vs server contexts, and missing .gitignore entries. Repos using AI assistants have 40% higher exposure rates.
What should I do if my API key is exposed?
Immediately rotate the key in your provider's dashboard, remove it from client-side code, and move it to a server-side environment variable. Check your git history for committed secrets; they persist even after removal. Use a secrets scanner in CI/CD to prevent future exposures.
More Free Tools
Source Map Scanner
Free source map exposure scanner. SaaSalyst checks if your JavaScript .map files are publicly accessible, exposing your source code.
Hosting Platform Detector
Free hosting platform detector. SaaSalyst identifies Vercel, Netlify, Cloudflare, Fly.io, and Render from HTTP response headers.
Chat Widget Detector
Free chat widget detector. SaaSalyst detects Intercom, Crisp, Zendesk, Drift, and Tawk.to widgets as part of contact mechanism scanning.
References & Official Sources
Official regulatory and standards sources relevant to the checks SaaSalyst runs on your site.
- OWASP Top 10· OWASP
- Security Headers Reference· Mozilla
- HSTS Preload List· Google
Scan your site for exposed API keys
118 business readiness signals. 30 seconds. No signup required.
Get my free score