DID YOU ACCIDENTALLY EXPOSE
YOUR PRIVATE API KEYS?
Scan your production website in 20 seconds. We download your client-side JavaScript bundles and verify whether secret tokens, Stripe keys, or Supabase admin credentials are leaking to visitors.
DETECTED PATTERNS
CREDENTIALS AUDITED BY SCANMYVIBE
Stripe Secret Keys
sk_live_...Allows unauthorized attackers to create charges, issue refunds, or download customer billing data.
Supabase service_role Keys
eyJ... (role: service_role)Bypasses Row Level Security (RLS) and grants complete administrative control over your PostgreSQL database.
AWS Access Key IDs
AKIA...Enables unauthorized API requests against your AWS infrastructure, S3 buckets, and cloud instances.
GitHub Personal Access Tokens
ghp_..., gho_...Exposes private repositories, source code, pull requests, and continuous integration workflows.
Environment (.env) Files
DATABASE_URL=..., SECRET=...Full server takeover by downloading exposed root .env files left accessible on production servers.
EMERGENCY RESPONSE
WHAT TO DO IF AN API KEY IS LEAKED
Rotate the Key Immediately
Do not just delete the code from GitHub. Revoke the token inside Stripe, AWS, or Supabase so existing leaked credentials become useless.
Fix Environment Prefixes
Ensure private variables never use NEXT_PUBLIC_ or VITE_ prefixes, which instruct frontend bundlers to bake secrets into browser code.
Verify via ScanMyVibe
Run a fresh scan on your production URL to guarantee that no caching layer or CDN is continuing to serve the old leaked bundle.
CHECK YOUR CODEBASE IN 20 SECONDS
Free, fast, automated scan. No sign up or credit card required.