How Secret Detection Works
AIExposureTool scans your publicly accessible JavaScript bundles for 17 known API key and secret patterns. Here's exactly how it works, what it finds, and what to do if a key is detected.
How the scan works
Fetch homepage HTML
The scanner requests your homepage URL and downloads the full HTML response.
Extract all JavaScript bundle URLs
All <script src='...'> tags are parsed. Both inline and external scripts are collected, including lazy-loaded chunks referenced in the bundle manifest.
Fetch each JavaScript bundle
Each bundle file is downloaded in full — these are the same files your users' browsers download when they visit your site.
Scan against 17 regex patterns
The full content of each file is scanned against 17 regular expression patterns for known secret formats — Stripe, OpenAI, Supabase, AWS, and 13 more.
Report matches with context
Any match is reported with the file it was found in and the line context (with the key value partially redacted in the UI).
Why AI-built apps are especially vulnerable
When a developer prompts Cursor, Claude, or ChatGPT to "add Stripe payments" or "connect to Supabase", the AI often generates working code quickly — but may write the API key directly into the component:
// AI-generated code — key hardcoded in client component
const stripe = loadStripe('sk_live_abc123...'); // ❌ secret key, not publishable key
const supabase = createClient(url, 'eyJhbGciOiJIUzI1NiJ9...'); // ❌ service_role keyThis code works perfectly — but the secret key ends up in the JS bundle that browsers download. Anyone who opens devtools, or any automated scanner, can extract it in seconds.
All 17 detected patterns
Stripe secret key
sk_live_[a-zA-Z0-9]{24,}Stripe webhook secret
whsec_[a-zA-Z0-9+/]{32,}OpenAI API key
sk-[a-zA-Z0-9]{32,}Anthropic / Claude key
sk-ant-[a-zA-Z0-9\-]{32,}Google Gemini key
AIza[a-zA-Z0-9\-_]{35}Supabase service role key
eyJ[a-zA-Z0-9]{100,} (JWT with role:service_role)AWS access key
AKIA[A-Z0-9]{16}Razorpay key
rzp_(live|test)_[a-zA-Z0-9]{14}Twilio auth token
[a-f0-9]{32} (near Twilio account SID pattern)SendGrid API key
SG\.[a-zA-Z0-9\-_]{22}\.[a-zA-Z0-9\-_]{43}GitHub personal access token
gh[pousr]_[a-zA-Z0-9]{36}Slack bot token
xoxb-[0-9a-zA-Z\-]{50,}Mailgun API key
key-[a-zA-Z0-9]{32}HubSpot API key
[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}Cloudflare API token
[a-zA-Z0-9_\-]{40}Intercom API key
dG9rOm[a-zA-Z0-9]{40,}Braintree access token
access_token\$production\$[a-z0-9]{16}\$[a-f0-9]{32}FAQ
How does the scanner access my JavaScript bundles?
The scanner fetches your homepage HTML, parses all <script src='...'> tags, then fetches each JavaScript bundle file. This is exactly what a browser does — the scanner sees only publicly accessible files.
What if my key is minified — does the scanner still find it?
Yes. Minification changes variable names and whitespace but does not change string values. API keys are string literals that survive minification unchanged. The regex patterns match against the raw bundle content regardless of minification.
I got a false positive — the scanner found something that isn't a real key. What do I do?
False positives can occur when a string matches the format of a key pattern but isn't actually a secret (e.g., a UUID that resembles a HubSpot key). If you're confident it's a false positive, verify by checking whether the string is actually used as an API credential in your code. If it is a real key but it's public-intentional (e.g., a Stripe publishable key, not a secret key), that's expected — publishable keys are designed to be public.
My Stripe publishable key (pk_live_...) was flagged — is that a problem?
No — Stripe publishable keys (pk_live_...) are designed to be public and used in client-side code. AIExposureTool specifically checks for secret keys (sk_live_...) and webhook secrets (whsec_...), which should never be client-side. If you see a publishable key flagged, check that it isn't being reported as a secret key.
What should I do immediately if a secret key is found?
1. Rotate the key immediately in the provider's dashboard (Stripe, OpenAI, Supabase, etc.). 2. Check your provider's access logs for any unauthorized usage. 3. Move the key to a server-side environment variable. 4. Redeploy your site. 5. Verify the key no longer appears in your JS bundles by re-scanning.
Scan your site for exposed secrets
Free — no signup. Results in 15 seconds.