We look for API keys from 30 services in 63 formats, up to 39 file paths that should never be public, source maps, HTTPS and security headers. The other 4 test your database rules, only after you verify you own the app and have the Fix Pack or Stay Locked.
| What we check | Checks | Typical severity | Why it matters |
|---|---|---|---|
| AI provider keys in your code OpenAI, Anthropic, OpenRouter, Groq, xAI, Hugging Face, Replicate, Perplexity, Google/Gemini | 9 | Critical (Google: Medium, High if Gemini is used nearby) | Anyone who opens your site can copy the key and run AI requests billed to your account until you revoke it. |
| Payment, cloud and service keys Stripe live/test secret, AWS, GitHub, Slack, SendGrid, Resend, Twilio, Shopify, Mapbox secret, Pinecone, PostHog personal, npm, DigitalOcean, Algolia admin, private-key blocks | 16 | Critical / High (Stripe test key: Medium) | These keys let someone act as your app: refund payments, read customers, send email or texts as you, or reach your cloud and code. |
| Database master keys (Supabase, Firebase) Supabase service_role key, sb_secret_ key, Supabase personal access token (sbp_), Firebase/Google service-account JSON | 4 | Critical | These keys skip every database rule, so whoever has one can read, change or delete all of your data. |
| Email, chat and bot keys Slack and Discord webhook URLs, Telegram bot tokens, Brevo, Mailgun and Postmark keys (Mailgun, Postmark and Telegram only count next to the service's name) | 6 | High | Anyone can post as your app in your team's channels or send email from your domain, which is how phishing gets your logo on it. |
| Secrets in public env variables A secret-looking value in a VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_ or REACT_APP_ variable | 1 | Medium | Those prefixes tell your build tool to ship the value to the browser, so every visitor gets it. |
| Files that should never be public /.env files (incl. .env.staging, .env.prod), /.git, database dumps (dump.sql, db.zip), /env.js or /config.js holding secrets, /.cursor/mcp.json, /.DS_Store, supabase/config.toml, firebase.json, .vscode, .replit, .cursorrules | 7 39 paths | Critical (.env, .git, dumps) / High (MCP config) / Medium / Low | A public .env or database dump usually holds every secret and every user you have; a public .git lets anyone download your code and its history. |
| Exposed endpoints and debug pages Public OpenAPI/Swagger files, a GraphQL endpoint that answers anonymous GETs (we never send a query), directory listings, phpinfo / server-status / Spring actuator pages, OAuth metadata that publishes a secret | 5 | High (debug pages, OAuth secret) / Medium / Low (GraphQL) | These hand an attacker a map of your API and server, or the server settings themselves, before they've tried anything. |
| Leftovers in your code A password typed into your JavaScript, a server error page showing a stack trace | 2 | High (password) / Low (stack trace) | A password in your JavaScript is readable by every visitor, and a stack trace shows your file paths and code to anyone who triggers it. |
| Internal addresses and admin routes New: reported, not in the grade yet localhost:3001, *.internal or staging hosts, and /admin-style routes in your JavaScript | 2 | Low (reported, not graded yet) | They show attackers where to aim: a staging API or an admin page is often less protected than your main app. |
| Source maps Public .js.map files that rebuild your original code (we also scan them for keys) | 1 | Low (a key inside takes the key's severity) | Your original code becomes readable, and keys you removed from the build can survive inside the map. |
| HTTPS and security headers Plain HTTP, http:// files on an HTTPS page, no CSP, no HSTS, no clickjacking protection, no nosniff, no Referrer-Policy | 7 | High (no HTTPS) / Medium / Low | Without HTTPS anyone on the same Wi-Fi can read logins; the headers limit the damage if a bad script gets in. |
| Login cookies New: reported, not in the grade yet A session, auth or token cookie set without Secure or HttpOnly. Third-party and analytics cookies are an info note only | 1 | Medium (reported, not graded yet) | A login cookie that scripts can read, or that can travel over plain HTTP, is easier to steal, and a stolen cookie is a stolen login. |
| Third-party scripts New: reported, not in the grade yet A <script> from a public CDN (jsDelivr, unpkg, cdnjs and others) with no integrity= check. Font and analytics scripts are an info note only | 1 | Low (reported, not graded yet) | If that CDN file is ever changed or hijacked, the new code runs on your site with full access to your users' pages. |
| CORS (main page) Access-Control-Allow-Origin: * on your homepage | 1 | Low | It lets any website read your page's responses from a visitor's browser; on an API with private data that's a real leak. |
| Database access rules (owner-verified, paid) Fix Pack / Stay Locked, verified owners Supabase table readable with the public key, Firebase Realtime DB, Firestore, Storage | 4 | Critical (Storage: High) | Your public database key is in every browser by design, so your rules are the only lock. If they're open, anyone can pull your users' data. |
| Total | 67 | 63 free + 4 owner-verified | |
Where we look for keys: your page HTML, up to 20 JavaScript bundles plus up to 10 lazy-loaded chunks, up to 3 public source maps, and any project file we find exposed. On apps with many bundles, a scan may run fewer of the optional file and source-map checks, which is why we say "up to 39" paths. /.env and /.git are always checked.
Key services: OpenAI, Anthropic, OpenRouter, Groq, xAI, Hugging Face, Replicate, Perplexity, Google, Stripe, AWS, GitHub, Slack, SendGrid, Resend, Twilio, Supabase, Shopify, Discord, Telegram, Mapbox, Pinecone, PostHog, npm, DigitalOcean, Brevo, Mailgun, Postmark, Algolia, Firebase. Plus private-key blocks and a check for secrets in public env variables.
"Info" notes (like "Supabase detected") are shown on reports but aren't counted as checks and don't affect the grade.