JavaScript Secret Scanner
Scans your browser JavaScript for leaked API keys and credentials like Stripe, AWS or Supabase.
What it checks
This scanner reviews the JavaScript your site sends to the browser, looking for patterns of API keys and credentials such as Stripe, AWS or Supabase. It flags secrets that were mistakenly bundled into the client-side code. It only inspects what is already public to any visitor.
Why it matters
Anything shipped in browser JavaScript is visible to anyone who opens the developer tools. A secret key there can be used to access your services, spend your money or read your users' data. It is a very common mistake when server and client variables get mixed up.
How to fix it
Move all secret keys to the server and access them only from the backend, never from browser code. Use only public or restricted keys on the client, and rotate any secret that has already been exposed. In many frameworks, variables without the public prefix stay on the server only.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free