Is your app leaking keys?

AI tools sometimes leave secret keys — Stripe, Supabase service keys, AWS, OpenAI — sitting in the code your site sends to every visitor. Paste your site's public link and we'll check the page and its scripts, the same way Plyo checks every project before it publishes.

We fetch only the address you enter (plus its own script files), scan it, and show the result to you alone. Nothing is stored. This catches the common serious leaks; it's a first line of defense, not a full audit.