Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Entropy scanning and regex fingerprinting for Stripe live keys, AWS Access Keys, OpenAI tokens, GitHub PATs, and Supabase service role secrets.
Canonical test payload dispatched during security surface audits.
NEXT_PUBLIC_STRIPE_SECRET_KEY=sk_live_...Watch the probe engine test this signature in an isolated sandbox.
Environment Variable Isolation
export const stripeKey = process.env.NEXT_PUBLIC_STRIPE_SECRET_KEY;
export const stripeKey = process.env.STRIPE_SECRET_KEY; // Server-only context
Never prefix sensitive private credentials with NEXT_PUBLIC_ or expose them in browser bundles.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for API Key Exposure Scanner.
Checks commonly evaluated alongside API Key Exposure Scanner during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect dangerous CORS policies that allow unauthorized third-party origins to invoke authenticated APIs.
Audit your site across all 41 vectors automatically on every deploy.