Free scanner
Scan your live app for leaked keys and open tables
Paste the public URL of an app you own (or are authorized to test). We fetch the HTML and same-origin JavaScript only, look for secret-looking keys, and — if a Supabase project is visible — run a read-only anonymous table check. No row data is returned.
Passive check only. Use only on apps you own or are authorized to test. This is not a full security audit, penetration test, or compliance certification. Results cover only the checks listed below, at the time of the scan. See scanner terms.
What we check
- · Stripe
sk_live_/sk_test_and OpenAI-stylesk-keys in HTML/JS (shown masked) - · Supabase
service_roleJWTs (payload role decoded; value masked) - · Supabase project URL + anon key presence
- · If both are found: PostgREST OpenAPI table list, then anonymous
countonly per table (never row contents)
Limits
- · Public http(s) only; private/internal IPs and credentialed URLs blocked
- · Caps on HTML/JS size and script count; per-IP rate limit
- · Same-origin scripts only — third-party CDNs are not fetched
- · No login, no authenticated user tests, no writes, no brute force
Want it fixed and verified?
Rescue is $149 flat: we fix the agreed issues and hand you a before/after verification report within 48 hours of working access. Scoped up to about 10 tables and 1 webhook — not a full audit.
Start a Rescue, $149