If you build with Lovable, Bolt or Replit, your code ends up in a repo you probably never open. So I scanned 54 of them — public repos, picked by "recently updated".
19% had something worth fixing. 15% had a password or an API key pasted straight into the code — one of them in a .tsx file, which means it ships to every visitor's browser. Two more were API keys sitting in SETUP.md, which is the sneakiest one: source files get checked, setup docs don't.
Honestly, at first my scanner got this wrong. It reported 4x more criticals than were real — a lone -----BEGIN PRIVATE KEY----- header counted as a leak, and every committed .env was "critical" even when it only held public Supabase values. Fixed both.
Two things worth checking in your own project:
Is your .env file in the repo? It starts with a dot, so it's invisible in most file browsers, and plenty of people assume it stays local. It doesn't — if it got committed, it's on GitHub for anyone to read. Run git ls-files | grep -i env in your project folder to find out.
Is your key actually secret? If a variable name starts with VITE_ or NEXT_PUBLIC_, the build tool deliberately bakes its value into the code sent to the browser. That's what the prefix is for. So VITE_OPENAI_API_KEY isn't hidden — any visitor can open devtools and read it.
Tool is free, no signup: defcod.vercel.app. Engine is MIT: github.com/Nqspq/defcod-engine
Top comments (0)