Check your app for leaked API keys and secrets
Check whether you leaked API keys or secrets before you push, open-source, or launch your app. Finds .env files git tracks or kept in history, server keys exposed to the browser through NEXT_PUBLIC_ or VITE_, Stripe, AWS, OpenAI, Anthropic, and Supabase key shapes, and hardcoded passwords, then walks you through fixing and rotating them. Reports names and redacted hints, never the values.
- Activity
- New: be the first to try it
Will this work for me?
- Effort
- Needs about 10 minutes of setupOur guess from what the kit says it needs.
- Works in
- Claude Code, claude.ai and the desktop app
- You need
Anthropic account: setup steps
- What it is
- This kit works with your own Anthropic account.
- Where to get it
- Sign in to Anthropic, or make a free account if it offers one. Go to Anthropic
OpenAI account: setup steps
How this works
- It is a skill: written instructions Claude reads when your request matches what the skill is for. You do not call it by name; just ask for the task.
- While it works, it reads and changes files in the places it lists, nowhere else.
- It runs these commands on your computer: node scripts/secrets-scan.mjs, git ls-files, git log.
- Nothing runs until you choose to use it, and you can remove it any time.
What it can access
What this kit says it will touch, the same list you see before you add it. These are its Permissions: What a kit is allowed to touch on your computer or accounts, such as reading a folder or using the internet. You see them before you add it.. In Claude Code they become rules, so Claude stops anything not on the list.
Command
Runs the command: node scripts/secrets-scan.mjs (with any arguments, without asking)
Command
Runs the command: git ls-files (with any arguments, without asking)