How to check if your website leaks API keys
Anything in your frontend code is public. If an AI assistant put a secret key in a React component or a NEXT_PUBLIC_ / VITE_ variable, it ships to every visitor's browser.
Check by hand
- Open your live site and press F12 (Cmd+Option+I on Mac).
- Go to Sources (Chrome) or Debugger (Firefox) and press Ctrl+Shift+F to search all files.
- Search for sk-, sk_live_, sk-ant-, AKIA, service_role, ghp_ and -----BEGIN.
- Also open /.env and /.git/config on your domain. They should return 404.
Which keys are fine in the browser
Publishable keys are meant to be public: Stripe pk_live_, the Supabase anon key, Firebase apiKey and Google Maps keys restricted to your domain. Secret keys are not: OpenAI and Anthropic keys, Stripe sk_live_ and rk_live_, AWS secret keys and the Supabase service_role key.
If you find a secret key
- Revoke or rotate it with the provider right away. Removing it from the code is not enough; it may already be copied.
- Move the API call to a server route or serverless function and keep the key in a server-only environment variable.
- Check the provider's usage page for calls you didn't make.
Let a scanner do it
SafeCheck downloads your site's JavaScript bundles and checks them for secret keys from OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase and more. The free scan tells you if anything leaked.
Check your app now. Free, no signup, under a minute.
Scan your appMore guides: Is my Lovable app secure? A 5-minute check · How to check if Supabase RLS is enabled (and fix it) · Firebase test mode rules: how to tell if your database is open · OpenAI API key exposed in your frontend? Do this now · Security checklist for apps built with Bolt, Cursor, v0 and Replit · Is this Claude skill or MCP server safe to install? A 5-minute check