DetectExposedSecrets

Scan JavaScript files for API keys, tokens, and secrets

Why Supaleak

The problem we solve

Modern development reality: development teams are shipping faster than ever. Vibecoding, visual coders, low-code tools, and rapid prototyping mean code is deployed in hours, not weeks.

You know the drill: ship fast, break things, fix later. But those secrets? They don't wait for your next sprint.

While this speed enables innovation, it also increases the risk of exposing sensitive credentials—API keys, tokens, and secrets—in JavaScript files.

The solution

Supaleak provides continuous monitoring of your production websites, automatically scanning JavaScript files for exposed secrets after launch. Catch leaks before attackers do, minimize security risks, and protect your infrastructure—all while maintaining your development velocity.

Free Supabase Scanner

Scan your website for exposed Supabase credentials and check RLS configuration

  • Free • 2 scans per day • No account required

How It Works

Simple workflow

01

Add Website

Add single URL or bulk import multiple websites from file (.txt or .csv)

02

Scan

Automatically scans JavaScript files using Kingfisher rules to detect API keys, tokens, and secrets

03

ValidatePRO

Validate detected secrets to check if they're active and identify exposed sensitive data (Pro feature)

04

Schedule & MonitorPRO

Set up automated scans with scheduling and receive email notifications when new secrets are detected (Pro feature)

Detect secrets from

  • AWS
  • Slack
  • Supabase
  • GitHub
  • Stripe
  • Google Cloud
  • Azure
  • Firebase
  • SendGrid
  • Twilio
  • DigitalOcean
  • Vercel
  • MongoDB
  • PostgreSQL
  • Redis
  • OpenAI
  • Anthropic
  • Shopify
  • PayPal

Why Validate?

PRO

Reduce false positives and focus on real vulnerabilities. Scans detect potential secrets, but many are false positives—test keys, example values, or already-revoked tokens. Validation checks if secrets are actually active and exposed, so you only fix what matters.

  • 8 secrets \n Scan finds secrets \n Supaleak validates \n - 3 real \n - 5 false \n False positives removed \n Fix real issues \n Validation tests each detected secret to verify if it's actually active and exposed. This eliminates false positives—test keys, example values, and revoked tokens—so you only spend time fixing real security issues.

Why Scheduled Scans?

PRO

Continuous protection for your production sites. You're constantly pushing code to production. While vibe coding, it's easy to accidentally leak secrets in JavaScript files. One-time scans miss new deployments, but scheduled scans catch leaks as they happen.

Scheduled scans run automatically at your chosen intervals (daily, weekly, or custom), ensuring you're notified immediately when secrets appear in production—even if you deployed hours ago.

Pricing

Choose your plan

free

$0/month

  • 1 website
  • 3 scans total
  • 1 scheduled scan
  • ×Bulk import
  • ×CSV export

pro

$20/month

  • Unlimited websites
  • Unlimited scans
  • Unlimited scheduled scans
  • Bulk import
  • CSV export
  • Email notifications

Upgrade to Pro