Keys that are meant to be public

The ones other scanners flag and shouldn’t.

These are normal

Stripe publishable keys (pk_live_…), Supabase anon keys, Firebase web API keys (AIza… alongside a firebaseConfig), Clerk publishable keys, analytics project keys. All are designed to ship in browser code.

We list them at informational severity so you know we looked, and so you are not alarmed when a different tool reports one as a breach.

One thing still worth doing

Restrict them. A Google Maps browser key with no HTTP-referrer restriction can be lifted and used against your quota — not a data breach, but your bill. Google Cloud console → Credentials → Application restrictions.

For Firebase, the equivalent is your security rules. The key being public is expected; open rules are not.

Not sure whether this applies to you?

Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.

Check a site