KeySpotter – Exposed API Key Finder

Websites sometimes ship secret keys to every visitor by mistake. A forgotten line in a script bundle, a settings object or a response from the site's own backend can hand out access that was meant to stay private. A live shop still running on test-mode payment keys is a quieter version of the same slip: it may let people check out without paying. KeySpotter looks for these slips while you browse. It checks the source code, the scripts that were loaded, browser storage and the responses the page receives from its backend, then scores each finding by how likely it is to be real. A small alert appears in the corner only at 90% confidence or higher, once per finding on each site. You can mute any site with one click. The full report explains what each finding means, how serious it is and how to fix it. You can copy a short, masked note for the site owner, so the problem gets reported without repeating the secret. Detection covers providers such as OpenAI, Anthropic, Stripe, AWS and GitHub, along with many others. Privacy comes first. Scanning happens inside your browser. KeySpotter never sends a found key anywhere, never tests a key against any service, and has no analytics, accounts or servers. To scan scripts, it downloads them once more; cookies are sent only to the website you are on, and redirects and private-network addresses are refused. Source maps and security.txt are requested only when you click. Scan results, including found values, are deleted when you close the tab. Made by Tahir Nazir.