API Key Exposed
Scans a live website for secret keys left in public, and tells you exactly how to remove them.
The problem
Shipping fast is how a thing gets built, and it is also how a key ends up in a JavaScript bundle. The person who did it cannot see it, because from the outside their site looks fine — and the scanners that do find it hand back a list of warnings written for somebody who already knows what to do.
The insight
Look at the site the way an attacker does, then answer the way a colleague would. Finding the key is the easy half; the half that changes the outcome is a copy-paste fix written for the exact platform the site is running on.
How it works
- Paste in a live site URL. No account.
- The scanner fetches the same paths an attacker would check — pages, JavaScript bundles, source maps, public config files.
- Key patterns for 50-plus services are matched against everything it pulled.
- It returns the exact fix for the platform that site is hosted on, not a generic warning.
Materials and process
Web application with a scanning service behind it.
What exists now
The scanner is live and working at apikeyexposed.pages.dev. Its own domain is not connected to it: apikeyexposed.com currently serves nothing, because stale records point somewhere the product no longer lives. The tool works; the front door does not.
Next: Point the domain at the product. It needs a dashboard login, which is why it has outlived several attempts to fix it from the command line.