METHOD
A scanner that understands public keys
Provider contracts determine urgency, not the word “key”.
01
Render the public app
02
Recognize key formats
03
Set the evidence level
04
Discard raw evidence
Scope of this report
One bounded render of the public client surface, with no repository or backend access.
Covered
Provider-specific formats in observed public sources.
Keys designed for browser use.
Generic patterns that deserve manual review.
Not covered
Whether a probable credential is active or privileged.
Whether public provider configuration is safely restricted.
Unvisited routes, repository history, backend code, or CI logs.
USE CASES
Three builds worth inspecting
Inspect the build when a change could alter what reaches the browser.
PRE-DEPLOY
01
Inspect before deployment
A Vite or Next.js build is ready to move from preview to production.
Decision
Separate expected client config from values that must stay server-side.
NEW INTEGRATION
02
Review a new SDK integration
Stripe, Supabase, or Firebase has just been added to the frontend.
Decision
Check what the integration actually shipped without returning raw values.
KEY ALERT
03
Triage a reported key
A teammate or scanner has flagged a credential-shaped string in the client.
Decision
Avoid rotating public config by reflex and handle confirmed secrets first.