Check your website's JavaScript for leaked API keys
Free tool that scans the JavaScript your website serves for leaked secret API keys from OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase and more. Results are masked and never stored in full.
Secret API keys belong on a server. When one ends up in a JavaScript bundle, anyone can open DevTools, copy it and run up your bill or read your data. This is one of the most common mistakes in sites built quickly with AI tools.
What this checker does
It loads your homepage and up to 24 more pages on the same site, collects every same-site JavaScript file they reference, and scans the code for well-known key formats. Each match is verified against the provider's format to reduce false positives, then masked.
What to do if a key is found
- Revoke the key immediately in the provider's dashboard. Assume it has been copied.
- Create a new key and store it as a server-side environment variable.
- Move the API call to the server, for example a Next.js route handler, a serverless function or your backend, and call that from the browser.
- Check your provider's usage logs for activity you do not recognise.
Limits
This tool only sees JavaScript that is publicly served. It cannot see keys in server code, environment variables or private repositories, and it does not try to use any key it finds.
Checks included
| Check | Severity | How to fix |
|---|---|---|
| Secret API key found in public JavaScript Anyone can open DevTools and copy the key. Leaked keys lead to stolen data and surprise bills. | critical | Revoke/rotate the key now, then move the call to a server-side route or function so the key never reaches the browser. |
| Credential found in public JavaScript This looks like a credential that should not be shipped to browsers. | high | Confirm what the credential grants, rotate it, and move its use to the server side. |
| Google API key found in public JavaScript Browser-side Google keys (Maps, Firebase) are normal, but an unrestricted key can be abused by others at your cost. | low | In Google Cloud Console, restrict the key to your domains (HTTP referrers) and to only the APIs it needs. |
| Supabase anon (public) key found The anon key is meant to be public, but it can read any table without Row Level Security (RLS). | info | Make sure RLS is enabled on every table. Verify your domain in Wardzo to unlock the open-table check. |
This free tool runs the full passive Wardzo scan and shows these checks first. Nothing is stored in full: secrets are masked, and anonymous reports are deleted after 30 days.
Frequently asked questions
Which keys can it detect?
Secret keys for OpenAI, Anthropic, Stripe (live secret and restricted keys), AWS access key IDs, GitHub tokens, Slack tokens, SendGrid keys, private keys in PEM format and Google API keys. Supabase keys are decoded to tell the public anon key from the service_role key.
Do you store the keys you find?
No. Wardzo keeps only a masked prefix, such as the first few characters and the total length, so you can identify the key. The full value is never stored.
Is a Google Maps or Firebase key in my JavaScript a problem?
Google browser keys are designed to be public, so Wardzo reports them as low severity. Make sure they are restricted by HTTP referrer and API in the Google Cloud console.
Related
- How to find leaked API keys in your website's JavaScript (and fix them)
A practical guide to finding secret API keys exposed in client-side JavaScript, telling public keys from secret ones, and moving API calls to the server safely.
- What are source maps, and are public source maps a risk?
Source maps are .map files that map minified JavaScript back to the original source code. Publicly served production source maps expose your full front-end source.
- Website security and SEO checks for vibe coders
Built your site with Lovable, Bolt, v0, Replit or Cursor? Wardzo checks the live result for leaked API keys, exposed files, missing security headers and SEO mistakes, and gives you fixes you can paste into your AI.