Shipping secret API keys to the browser
Environment variables starting with NEXT_PUBLIC_ in Next.js or VITE_ in Vite are embedded in the JS at build time. Put an OpenAI or Stripe key there and anyone can read it.
A pre-launch check for indie and AI-built apps
Check your website's security
for free, with just a URL
Checks your SSL certificate, security headers, cookies, email spoofing protection and API keys leaked in public JS, all in 1 to 2 seconds. Every problem comes back with a fix for Next.js and Vercel, plus a fix request you can hand to an AI agent.
- Free, just sign up
- Done in 1 to 2 seconds on average
- No port scans or other intrusive tests
$ target your-app.vercel.app
Example
D58/100
3 items need action
- Action needed
- 3
- Warning
- 4
- Passed
- 9
- Connect over HTTPS and check the certificateHTTP 200 · TLSv1.30.21s
- Check security headers and cookiesPassed 3 / 70.00s
- Fetch public JS and search for secretsChecked 8 JS files0.34s
- Check SPF and DMARCSPF OK · DMARC Warning0.02s
- Secrets in public JavaScriptSeverity: Critical
- Clickjacking protectionSeverity: Medium
- CSP (allowed script sources)Severity: Medium
Six areas we check
Of everything visible from the outside, these are the settings indie sites most often miss and the ones most likely to cause real damage.
Leaks from public JS
Searches the JS your site sends to browsers for secret API keys, using each provider's key format.
- OpenAI, Anthropic
- Stripe sk_live_
- Supabase service_role
- AWS, GitHub
Encryption
Checks that the site loads over HTTPS, the certificate is valid and not about to expire, and no outdated TLS is used.
- SSL certificate
- Expiry
- TLS version
- CAA
HTTPS enforcement
Checks that http redirects to https and that HSTS tells browsers to always use HTTPS.
- http to https
- HSTS
- max-age
Browser security headers
Checks for response headers that limit the damage from clickjacking and XSS.
- CSP
- X-Frame-Options
- nosniff
- Referrer-Policy
Cookies
Checks that cookies set by your top page carry the attributes that make them hard to steal.
- Secure
- HttpOnly
- SameSite
Email spoofing protection
Checks that receivers can recognize spoofed mail that claims to be from your domain.
- SPF
- DMARC
How it works
- 01
Enter a URL
Type a domain or URL and press "Scan". The first time, you need a free account.
- 02
Seven steps run in parallel
Connection, certificate, headers, public JS, DNS and more are checked at once, and results stream in as each step finishes. Most sites are done in 1 to 2 seconds.
- 03
Fix it, or hand it to AI
Copy the config for each item, or paste a fix request covering every problem into Claude Code or Codex.
Two common incidents in AI-built apps
AI-written code puts "it works" first, so where keys live and how data is protected often come later.
Leaving database RLS disabled
The Supabase anon key is meant to be public. Row level security (RLS) is the only thing protecting your data, so a table without it can be read and written by anyone. A leaked service_role key bypasses RLS entirely.
How to check Supabase RLSWhat we check, and what we never do
Anyone can scan a domain they do not own, so we only look at the same public information a browser sees when it opens the page.
What we check
- Response headers and HTML of the top page (http and https)
- Same-site JS loaded by the top page (up to 10 files)
- /.well-known/security.txt
- Public DNS records (SPF, DMARC, CAA)
What we never do
- Port scans, exploit attempts or login attempts
- Submitting forms or accessing databases
- Publishing results (secret locations are shown only to the verified owner)
User-Agent: ideavaluSecurityCheck/1.0 (+https://ideavalu.com/security-check)
How it differs from other free scanners
Free security scanners differ in what they check and who they are built for. Pick the one that fits your goal.
| What it checks | Secrets in public JS | Fixes | Best for | |
|---|---|---|---|---|
| IDEAVALU check | SSL, headers, cookies, SPF/DMARC, public JS | Checked | Config for Next.js and Vercel, plus a fix request for AI agents | Indie and AI-built apps |
| Typical passive scanners | Some of SSL, headers and so on, depending on the tool | Usually not checked | Mostly general explanations | Company sites and CMS operators |
| Vulnerability scanners (ZAP and others) | Application weaknesses in forms, logins and more | Not covered | Research it yourself | Developers with a test environment (owner permission required) |
| Paid professional assessments | In-depth testing, partly by hand | Depends on scope | Delivered in a report | Production services handling payments or personal data |
For a tool-by-tool comparison, see Free website security scanners compared.
Roundups and checklists
- Free Website Security Scanners Compared (2026)In short: to check a live site's configuration quickly, use a free passive scanner.
- Pre-Launch Security Checklist for AI-Built Apps: 10 ItemsAI-written code puts "it works" first, so where keys live and how data is protected often come later.
- Security Survey of 276 Indie App Websites (October 2026)On October 29, 2026 we ran a passive security check on 276 websites of indie apps listed on IDEAVALU, a Japanese launch platform for indie makers and students.
Guides and fixes for each check
For every item we check: what the risk is, commands to check it yourself, and how to fix it on Next.js, Vercel and other hosts.
- How to Find and Fix Exposed API Keys in Your Frontend JSAny JavaScript that reaches the browser can be read with developer tools.
- How to Check Supabase RLS Policies on Your TablesSupabase and Firebase let the browser read and write the database directly.
- How to Set Up HSTS on Next.js, Vercel and NetlifyHSTS tells the browser to connect to your site only over HTTPS from now on.
- How to Add a Content-Security-Policy Without Breaking Your SiteA CSP tells the browser where the page is allowed to load scripts, images and other resources from.
- How to Set Security Headers like X-Frame-Options and nosniffA few lines of response headers turn on defenses built into the browser.
- How to Check SSL Certificate Expiry and ErrorsWith an invalid certificate, visitors hit a browser warning page and most leave on the spot.
- How to Set Up SPF and DMARC to Prevent Email SpoofingWithout SPF and DMARC, anyone can send email that claims to come from your domain, and receivers cannot tell the difference.
- How to Set Secure, HttpOnly and SameSite on CookiesIf someone steals the cookie that keeps a user signed in, they can act as that user without a password.
Frequently asked questions
Is it okay to scan someone else's site?
The scan only looks at public information a browser sees when it opens the top page (response headers, HTML, the JS it loads and public DNS). We never run port scans, exploit attempts or login attempts. Where secrets were found is shown only to the person who verified ownership of the domain.
Why do I need an account?
To prevent mass scanning of other people's sites. Sign-up is free and takes seconds with a Google account. With an account you also get fixes, a fix request for AI agents and your scan history.
How long does a scan take?
Seven steps run in parallel, so most sites finish in 1 to 2 seconds and even slow servers in a dozen or so. Results for a domain are saved for 24 hours and shown instantly during that time.
How is this different from a vulnerability scan?
This is a passive check that uses only information anyone can see. A vulnerability scan sends attack-like requests to find application bugs such as SQL injection and XSS, and needs the site owner's permission. Combine this check with ZAP or a professional assessment as needed.
Does it check my domain too?
For the domain, we check email spoofing protection (SPF, DMARC), limits on certificate issuers (CAA), and the validity and expiry of the SSL certificate. DKIM, DNSSEC and MTA-STS are not checked.
Is it a problem if my Supabase anon key is found?
The anon (publishable) key is meant for the browser, so we do not flag it. You do need RLS (row level security) so nobody can read other users' data. If a service_role or secret key reaches the browser, revoke it immediately.
If I pass, is my site safe?
Not necessarily. This checks settings visible from outside, so passing is no guarantee. Check your login and payment flows, database access control and dependency vulnerabilities separately.
Are scan results published?
No page publishes scan results. Secrets themselves are never stored; we keep only a masked string with the first and last few characters.
How do I opt my site out of scans?
Our scanner identifies itself with the User-Agent "ideavaluSecurityCheck/1.0 (+https://ideavalu.com/security-check)". To opt out, send us your domain through the contact form.
Questions about the scanner? Reach us through the contact form (in Japanese; English messages are welcome).