KeyLeak Detector
Scan websites for exposed API keys and secrets
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
I built this after seeing multiple teams accidentally ship API keys in their frontend code.The problem: Modern web development moves fast. You're vibe-coding, shipping features, and suddenly your AWS keys are sitting in a <script> tag visible to anyone who opens DevTools. I've personally witnessed this happen to at least 3-4 production apps in the past year alone.KeyLeak Detector runs through your site (headless browser + network interception) and checks for 50+ types of leaked secrets: AWS/Google keys, Stripe tokens, database connection strings, LLM API keys (OpenAI, Claude, etc.), JWT tokens, and more.It's not perfect, there are false positives but it's caught real issues in my own projects. Think of it as a quick sanity check before you ship.Use case: Run it on staging before deploying, or audit your existing sites. Takes ~30 seconds per page.MIT licensed, for authorized testing only.https://github.com/Amal-David/keyleak-detector
HN · launched Nov 1, 2025 · 30 upvotes (top 25%) · 0 views
Niche: application and system security scanners · 260 launches, 34 in the last 7 days ▼ -6% · Explore this niche →
Category and tags
- Security
- Compliance & governance
- Developer
- Not AI
- Commercial product
Visit website ↗ Source listing ↗
More like this: all 260 launches in application and system security scanners →
Could you build this?
Yes A web scraper or crawler that inspects client-side HTML, JavaScript bundles, and source maps with regex patterns for common API keys (Stripe, AWS, OpenAI) is a standard utility readily vibe-coded.
Discussion
7 comments analyzed.
Competitors mentioned: Gitleaks, GitHub secret detection
Concerns raised: Gitleaks is more comprehensive for comparison, Runtime detection is limited compared to broader secret scanning, Underlying organizational/process problems are the real issue, Offensive security tools alone don't solve fundamental secret management flaws
Feature requests: Chrome plugin for runtime detection, CI/CD pipeline integration, Adversarial agent for vibe-coded apps
Competitors
Other products that read as similar to this one : 342 launches clear the similarity bar, closest 8 shown.
Attention rank: #87 of 343 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 2 days after the earliest competitor.
- Quick Scan First · ph · 2026-10-07 · 1 upvotes · similarity 0.51
- APIRadar – Open-Source API Key Scanner · ph · 2026-09-15 · 3 upvotes · similarity 0.50
- VibeAlarm · ph · 2026-11-12 · 1 upvotes · similarity 0.49
- PreFlight Kit · ph · 2026-11-06 · 1 upvotes · similarity 0.48
- Keman - Protection from leaked API keys · ph · 2026-10-30 · 1 upvotes · similarity 0.48
- Website Leak Scanner · ph · 2026-10-15 · 1 upvotes · similarity 0.47
- SecretEnv · hn · 2026-05-05 · 5 upvotes · similarity 0.46
- dev-utility APIs · ph · 2026-10-28 · 1 upvotes · similarity 0.46
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.