Free scan

Is an old project leaking your API keys?

Paste a public GitHub repo or a file. We look for API keys left in the code. You get a risk score in seconds. Keys stay hidden. We don't save what you paste.

Run a free scan

Free scan shows the problem. $9 one-time unlocks the full fix report. No subscription.

Example

Risk score (0–100)

High risk

2 possible keys · 1 .env file

OpenAIsk-proj•••••XXXX

AWSAKIA•••••XXXX

.env filecommitted

Sample screen for show only. Not a real scan.

Scan for free

Email me my results and occasional KeyCheck tips; unsubscribe anytime

We never ask for your keys or account logins. Public repos only. The scan matches patterns, so it can miss things or flag things by mistake.

🔍

We look for key patterns

We check for keys from 13 services, plus .env files and private keys. We scan up to 200 files.

🫥

Keys stay hidden

You only see part of each key, like sk-proj•••••a9F2. What you paste is not saved.

🛠

Clear fix steps

The $9 report shows how to replace each key, links to each dashboard, and a prompt for your AI coding tool.

What could a leaked key cost?

This is a rough guess you control. Change the numbers to fit you. It is not a forecast and uses no real cases.

Model type Tokens an abuser uses: 2M per hour Hours until you notice: 48 Your spend cap ($, 0 = none)

Possible cost

Prices are examples. Check your provider's price page.

Simple price

You pay first, then you see the full report. No surprise charges.

Free scan

Risk score
Count of keys and .env files
A few hidden previews

Full fix report

$9 one time

Every finding with file and line
Steps to replace each key
.env clean-up steps
A fix prompt to copy and paste

One payment. No subscription. Paid through Stripe (test mode now, no real charges).

What it checks, and what it doesn't

✅ Keys for OpenAI, Anthropic, Groq, Replicate, Hugging Face, Together, Google/Gemini, xAI, Stripe, AWS, GitHub, and private keys.
✅ .env files on the main branch (not .env.example).
⚠️ It does not check git history, other branches, forks, private repos, hosting sites, or browser JS files yet.
⚠️ It does not test if a key still works. A clean result does not mean you're safe.
⚠️ Big repos: we only scan the first 200 likely files. We tell you when that happens.