Is your app showing its secret keys to everyone?
Paste the public address of your Lovable app, or any web app. We download the page and the JavaScript files it loads, exactly as a visitor's browser would, and tell you whether any secret API key is sitting in them for anyone to copy. It is free and takes a few seconds.
Check your app
We fetch only public files, never store your URL or results, and never show a full key.
What this does and does not check
It checks
- The page at the address you paste, after up to 3 redirects.
- The JavaScript files that page loads from your own site (and Lovable's asset hosts), plus the code chunks those files load: up to 25 files, 6 MB each and 30 MB in all.
- Secret keys for Supabase, Stripe, Clerk, OpenAI, Anthropic, Resend, SendGrid, GitHub, AWS and Slack, plus private keys. Public keys that are built for browsers, such as the Supabase anon key, are listed for information.
It does not check
- Pages behind a login, and anything your app only loads after someone signs in.
- Your server code, edge functions, database or Supabase settings, including whether row-level security is on.
- Scripts from other companies, such as analytics or payment widgets.
- Your git history: a key you removed from the code may still be there.
A clean result means none of these keys were in the public files we read. It is not a security audit. For a wider look at what stands between your app and real users, take the free production-readiness check. If a key has already leaked, our guide to what to do when a Lovable API key is exposed covers the first hour, and the anon key vs the service role key explains which Supabase key is which.
Questions about the checker
Which keys are safe to have in my app's browser code?
Keys built to be public: the Supabase anon or publishable key, the Stripe publishable key (pk_live_ or pk_test_) and, if restricted to your domain, a Google Maps key. Anything called secret, service role, restricted or webhook, and every AI provider's key, must stay on a server. The checker lists public keys for information and flags the secret ones.
The checker found a secret key. What should I do first?
Rotate or revoke the key in the provider's dashboard straight away, before anything else. Deleting it from your code does not help on its own, because anyone who already copied it can keep using it. Then move the call that needs the key into a server or edge function that reads it from a secret, and check the provider's usage for anything you did not do.
Does a clean result mean my app is secure?
No. It means none of the secret keys we look for were in the public page and scripts we read. We cannot see pages behind a login, your server code, your database rules or your git history, and we only read the first 25 script files. Row-level security, authentication and payments need their own checks.
Do you store the address I paste or what you find?
No. The address and the results exist only while the scan runs, and the full value of a key never leaves our server: you see the first 6 and last 4 characters. To stop the tool being abused, your IP address is counted in memory (5 scans per 10 minutes) and never written down. We do not keep a database of scans.
Can I check a site that is not built with Lovable?
Yes. The checker works on any public website that serves HTML and JavaScript over https, including apps built with Bolt, Replit, v0, Cursor or by hand. It cannot check private or local addresses, IP addresses, or sites on a port other than the standard one.
Found a key, or not sure what to do next?
Our engineers rotate exposed keys without downtime, move every call server-side and add the checks that keep them there.
See vibe coding rescue