Website API key scanner

Find exposed API keys in your website

A secret in client-side code is public, even if it is hidden behind a polished interface. Scan your deployed site before a key becomes an incident.

Run a free scan

Paste your public app URL. You will get a plain-English report with evidence and practical fixes.

Scan my app

What VibeTester checks

Scans inline scripts and downloaded JavaScript bundles
Looks for common OpenAI, Stripe, AWS, Anthropic, Groq, and Supabase key patterns
Probes for publicly reachable .env and .git/config files
Checks security headers on the homepage

Why check before you share?

Environment variables only stay private when they remain on the server. If a real credential reaches a browser bundle, rotate it immediately and move the protected action server-side.

How it works

VibeTester checks publicly reachable code only. It does not log in as an attacker, bypass access controls, or replace a full security assessment.