Every check · Exposed files
Keys in scripts
What it checks
The site's own scripts, for live keys: Stripe secret key, AWS access key, GitHub token, Slack token, Slack webhook, SendGrid key, OpenAI key, Anthropic key, Private key.
Why it matters
Anyone can read a script a page loads, so a key in one is public, and can be used to run up bills or reach data.
How to fix it
- Revoke each key at its provider, and make a new one.
- Move the call that needs it to your server, so the key never reaches a browser.
- Check the provider's logs for what the key was used for.
Check a site for this and everything else: snag.page. More on exposed files: Exposed files Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users