Made a free checker that tells you if your web app is shipping secret keys in its JavaScript

The bug we kept running into in apps built with Lovable, Bolt, Cursor and similar tools isn't fancy. A secret key ends up in the frontend bundle. Sometimes it's a Supabase service_role key, an OpenAI key, or a Stripe sk_live. The app works fine, so nobody notices, but anyone who opens DevTools can read it.

So we built a free check for it: paste your app's URL and you get a grade a few seconds later.

What it actually does

• Loads the page and the JS files it references (same site plus the usual app CDNs, at most 15 files). That's the same stuff any visitor's browser downloads.
• Runs provider-specific patterns over that text (Supabase, Stripe, OpenAI, Anthropic, AWS, GitHub, Resend, SendGrid, Slack, private key blocks). For Supabase JWTs it decodes the payload and looks at the role, so the anon key gets explained instead of flagged.
• Checks for a public source map if a bundle points to one, and checks the main security headers.
• Masks anything it finds (first 8 + last 4 characters) and never tries to use the key.

What it doesn't do

• No logins, no guessing paths like /.env, no poking at your database. It's purely passive, so it can't tell you whether your RLS policies or auth checks are right, and an A doesn't mean "secure." It means nothing obvious is leaking in what you ship.
• It doesn't store your URL or the findings, only aggregate counts. (The exception: if you ask it to email you the report, it keeps your email, the URL and the grade so it can send it.)

If you want it, there's an optional domain verification step (DNS TXT or a meta tag). It runs the same passive scan, but you get a Verified badge, slightly longer key previews to help you find the key you need to rotate, and a higher hourly limit.

Tech side for the curious: it's a single Cloudflare Worker with an SSRF guard (https only, no private IPs, re-checked on every redirect), per-IP and per-site rate limits, and a robots.txt opt-out for its own user agent. There are no generic "high entropy" rules on purpose, because they were too noisy.

Link: https://lockedvibe.com/check?utm_source=reddit&utm_campaign=leak-checker-launch&utm_content=sideproject

It's free and doesn't need a signup. For transparency, we also sell paid security reviews, which is how this pays for itself, but you don't need any of that to use it.

The feedback we'd really like:

1. Did it flag anything you're sure is fine (a false positive)?
2. Any key formats you'd expect it to catch that it didn't?
3. Was the result page clear about what to do next?