Menu

Free tool

Find leaked keys before someone else does

Check what the public can already see in your public GitHub repo. You never type a secret here. Everything runs in your browser and nothing is uploaded to VibeLocked.

Needs nothing private: no login, no token. Your browser reads the repo from GitHub's public API and raw.githubusercontent.com, then checks up to 150 text files locally (skipping node_modules, lockfiles, binaries, and files over 200 KB). GitHub allows about 60 API calls per hour per network without login, and a scan uses three.

What it looks for

  • OpenAI, Anthropic, Google (Gemini, Maps), Groq, xAI, Replicate, Hugging Face tokens
  • Stripe secret and restricted keys, and webhook signing secrets
  • Supabase service role keys (legacy JWT with role service_role) and new sb_secret_ keys
  • AWS access key IDs and secret keys, GitHub and GitLab tokens, Slack tokens and webhooks
  • Twilio, SendGrid, Resend, Discord webhooks, private key blocks, and database URLs with a password
  • Generic secret assignments, such as SECRET=, TOKEN=, or PASSWORD= with a long value

Publishable values like a Stripe pk_ key, a Supabase anon key, or a Firebase web config are reported as safe to ship, so you can tell them apart from real secrets. See anon key vs service role key.

If it finds a live secret

Rotate the key at the provider first, then remove it from code and history. Deleting the line is not enough once it was pushed or deployed. Follow the first hour after an API key leaks and check your GitHub history.

Limits

The repo scan reads the current branch only, not old commits, and stops at 150 files. Pattern matching misses keys with no fixed format and can flag test values. A clean result is not proof that a project is safe. For private repos and full history, run Gitleaks or TruffleHog on your own machine or in CI.