Review the evidence
See the matching pattern, masked text, and the public file where it appeared. Possible matches need your judgment.
Deploy with more confidence
Check your website for exposed secrets
Enter a public page. We inspect its HTML and static, same-origin JavaScript for credential-like patterns, then show you where to look and what to do next.
Want to see a result first?
Scan report
Results for this page
Next actions
What to do with this result
Findings
Matches are clues, not proof that a credential works.
How to use the result
A clear next step for every match
Rotate a real credential
If a working secret was exposed, revoke or rotate it first. Then remove it from the public build and redeploy.
Check the new build
Rescan the same page. A missing match means it was not seen in the new scan; check the resource coverage too.
Scope of this check
This tool reads one public HTML page and static same-origin .js and .mjs references in that HTML. It does not check other routes, dynamically loaded code, source maps, API responses, login-only content, or whether a key is active. No match is not a security clearance.