# BundleSentry

> BundleSentry is a free, read-only scanner for credential patterns exposed in JavaScript that a public browser can already download.

Canonical site: https://bundlesentry.com/
French version: https://bundlesentry.com/fr/
Publisher: Webba Creative Technologies
Author: Luca Deguin
LinkedIn: https://www.linkedin.com/in/luca-deguin-7b99a1174/
Open-source engine: https://github.com/Webba-Creative-Technologies/vice
Method reviewed: 2026-07-15

## What the tool does

- Renders one authorized public HTTPS application under strict network and response budgets.
- Observes declared scripts, module preloads, inline code, and reachable lazy chunks.
- Separates browser-safe public configuration, probable credentials, and confirmed private secrets.
- Returns credential types and structural counts, never raw values, snippets, source paths, or bundle URLs.
- Makes no write request to the inspected application.

## Important limits

- The report covers only sources observed during one bounded public render.
- A generic credential shape does not prove that the value is active or privileged.
- Public Firebase, Stripe, and Supabase keys still depend on provider restrictions, rules, and RLS.
- Repository history, backend code, CI logs, mobile builds, and gated routes are outside the report.

## Primary sources

- Supabase API keys: https://supabase.com/docs/guides/getting-started/api-keys
- Firebase API keys: https://firebase.google.com/docs/projects/api-keys
- Stripe API keys: https://docs.stripe.com/keys
- Vite environment variables: https://vite.dev/guide/env-and-mode.html
- Next.js environment variables: https://nextjs.org/docs/app/guides/environment-variables

## VICE engine

BundleSentry uses a narrow public contract derived from the open-source VICE security engine:
https://github.com/Webba-Creative-Technologies/vice

The canonical HTML pages and sitemap remain the authoritative public inventory.