Free tool · Client exposure
Your app might be handing its database keys to every visitor.
Header scanners grade the envelope. This reads what your application actually ships to the browser and looks for credentials that were never supposed to leave your server — the failure that shows up again and again in fast-built and AI-assisted applications.
Why this check
The bundle is the blind spot.
Authentication usually gets attention because it is visible. What reaches the browser at build time does not: a key added to make one feature work in development is quietly compiled into production and served to everyone who loads the page.
How it stays safe
We read; we never try the key.
A Supabase service_role token declares its own privilege inside the token, so we decode that locally and show you the claim. Using a discovered credential against a live service to "confirm" it would be an attack, and we do not do it.
What you get
A rotation list, in order.
Each finding names the file it came from, a fingerprint you can grep your own source for, why it matters, and the specific action to take. Critical items are rotation-first: assume anything found here is already public.
Honest limits
A clean result here is a narrow result.
This tool inspects one page and the same-origin scripts it links to. It does not log in, guess file paths, read your repository, or see your server. The most expensive failures in fast-built applications — one customer reading another customer's records, database policies that were switched on but never written, webhooks that accept unsigned payloads — are invisible from outside and need an authorized review.
Found something? The next hour matters more than the next report.
If a credential is exposed, rotation comes first and architecture comes second. Noustiq can help with both: containing the immediate exposure, then reviewing why the boundary failed so the same class of mistake stops recurring.