LIVE LEAK CHECK

Is your API key in your live JavaScript?

A key in a NEXT_PUBLIC_ or VITE_ variable is written into your site when it builds. It never appears in your repo, so GitHub secret scanning and repo scanners cannot see it, but every visitor downloads it. Paste your live site to check.

What it looks for

• Stripe live and test secret keys, restricted keys and webhook secrets
• Supabase service_role keys and new secret keys, which bypass Row Level Security
• OpenAI and Anthropic API keys, the ones bots scrape and spend
• AWS access keys, GitHub tokens and private keys

Public keys such as Stripe pk_live_ and the Supabase anon key are listed as fine: they are meant to be in the browser.

How it works

DeployDoctor fetches your page over https and the JavaScript files on the same site, the same files a browser loads. It does not log in, click, submit forms or call your APIs. Found values are masked to their type and last four characters, and nothing about the site is saved.

Building the next launch? The vibe coder's launch manual covers environment variables, Stripe live mode and Supabase RLS step by step.