Checker
Is my API key exposed?
Paste the public URL. LeakWatch reads the HTML and the scripts that page loads, and looks for credential-shaped strings. It does not log in, and it does not use a secret it finds to call the provider.
The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. One free scan per network every 30 days.
What this page is for
Treated as a leak
OpenAI, Anthropic, Stripe secret keys, AWS access key IDs, standalone Google API keys, GitHub tokens, Resend, SendGrid, Slack, Twilio when the page mentions Twilio, private keys, and a Firebase Admin service account.
Public on purpose
A Supabase anon key, an sb_publishable key, a Stripe publishable key, and a Firebase web API key next to the client config. The anon key becomes serious only when it can read a table.
What you receive
The free report names every finding. The $19 Proof Report opens the masked value, the file it was found in, and a fix prompt. The full key is not stored.
Questions
- Do you store the key?
- No. A paid report can show the first four and last four characters. The middle is discarded.
- Does this use my one free scan?
- Yes. The same scan also checks headers, open tables, and public files.
A Proof Report is $19 once. Monitoring is $9/month. Pro is $29/month. No subscription is required for the report. See pricing.