LeakLock

About

LeakLock scans a live website, including its HTML, JavaScript bundles, lazy-loaded chunks and public source maps, for secret API keys shipped to the browser. It also flags keys with no recognizable prefix by looking at how the code uses them, and it classifies public-by-design keys such as Supabase anon keys as safe. This matters because keys set through frontend environment variables can be absent from git yet still be downloaded by every visitor, so repository scanners miss them.