I made a free checker for API keys shipped in your site's JavaScript

Most leaked AI keys I've seen this year weren't committed to GitHub. They were compiled into the frontend: a VITE_ or NEXT_PUBLIC_ variable, or a define block like the one Google AI Studio exports use for GEMINI_API_KEY. The key ends up in a JS file every visitor downloads, and scrapers find it.

So I built a checker: keyvaultedge.com/tools/key-leak-check

Enter your site's address. It downloads the page and the scripts it loads from its own site (the same files any visitor gets) and looks for OpenAI, Gemini, Anthropic, Stripe, AWS, GitHub, Slack, SendGrid, Groq, xAI, Hugging Face and Replicate keys.

• Results show only the provider and the key's public prefix (sk-proj-…(164 chars)), never the key, so it can't be used to harvest other people's keys. Nothing is stored.
• Firebase web-config keys (AIza… next to authDomain) are flagged "review", not "exposed". They're public by design; just make sure Gemini isn't enabled on that key.
• What it can't see: keys loaded after login, from another domain, or leaked server-side.

Put the same check in CI so it never ships

# after `npm run build`; use .next/static for Next.js
! grep -rEq '(^|[^A-Za-z0-9])(sk-[A-Za-z0-9_-]{20,}|AIza[0-9A-Za-z_-]{35}|sk_live_[0-9A-Za-z]{24,})' dist/

The (^|[^A-Za-z0-9]) prefix matters: without it, Tailwind's mask-image-* classes match sk-.

If it finds something: rotate first, then read the leaked-key checklist.

Disclosure: I build KeyVault Edge, a proxy that lets the browser use a capped, revocable token instead of the real key. The checker is free and doesn't need an account.