Scan JavaScript files for API keys, tokens, and secrets
Why Supaleak
The problem we solve
development teams are shipping faster than ever. , visual coders, low-code tools, and rapid prototyping mean code is deployed in hours, not weeks.
you know the drill: ship fast, break things, fix later.
but those secrets? they don't wait for your next sprint.
while this speed enables innovation, it also increases the risk of exposing sensitive credentials—api keys, tokens, and secrets—in javascript files.
supaleak provides continuous monitoring of your production websites, automatically scanning javascript files for exposed secrets after launch. catch leaks before attackers do, minimize security risks, and protect your infrastructure—all while maintaining your development velocity.
Free Supabase Scanner
Scan your website for exposed Supabase credentials and check RLS configuration
Free • 2 scans per day • No account required
How It Works
Simple workflow
Add Website
Add single URL or bulk import multiple websites from file (.txt or .csv)
Scan
Automatically scans JavaScript files using Kingfisher rules to detect API keys, tokens, and secrets
ValidatePRO
Validate detected secrets to check if they're active and identify exposed sensitive data (Pro feature)
Schedule & MonitorPRO
set up automated scans with scheduling and receive email notifications when new secrets are detected (Pro feature)
Detect secrets from
Why Validate?
PROReduce false positives and focus on real vulnerabilities
Scans detect potential secrets, but many are false positives—test keys, example values, or already-revoked tokens. Validation checks if secrets are actually active and exposed, so you only fix what matters.
Validation tests each detected secret to verify if it's actually active and exposed. This eliminates false positives—test keys, example values, and revoked tokens—so you only spend time fixing real security issues.
Why Scheduled Scans?
PROContinuous protection for your production sites
You're constantly pushing code to production. While vibe coding, it's easy to accidentally leak secrets in JavaScript files. One-time scans miss new deployments, but scheduled scans catch leaks as they happen.
Scheduled scans run automatically at your chosen intervals (daily, weekly, or custom), ensuring you're notified immediately when secrets appear in production—even if you deployed hours ago.
Pricing
Choose your plan
free
- 1 website
- 3 scans total
- 1 scheduled scan
- ×Bulk import
- ×CSV export
pro
- Unlimited websites
- Unlimited scans
- Unlimited scheduled scans
- Bulk import
- CSV export
- Email notifications