Launching today
Burnproof
Catch the leaked API key before it runs up your bill
1 follower
Catch the leaked API key before it runs up your bill
1 follower
Paste your live app's URL. Burnproof finds the OpenAI, Gemini, Anthropic, Stripe or Supabase service_role keys your AI-built app ships to the browser. Read-only, keys masked, every finding free, plus a fix prompt for Cursor, Lovable or Bolt.
Free Options
Launch Team
Dropbox SignSimple, secure eSignatures for the way your team works.
Promoted
Hey Product Hunt, I'm Jordan 👋
Coding agents are great at getting a demo working fast. One way they do it is by putting the OpenAI or Gemini key right in the frontend code. Then that key ships to every visitor's browser. Anyone who opens DevTools, or any bot scraping public pages, can copy it, and the provider bills you, not them. There are public stories of five-figure Gemini bills that started exactly this way.
I built Burnproof for the moment right before you share your link: on Product Hunt, on Reddit, or with a client. Paste your live URL and it:
🔑 looks in the HTML and same-origin scripts for OpenAI, Anthropic, Gemini, Stripe secret, AWS and Supabase service_role keys, and masks them (first 4 / last 4)
📂 checks whether /.env and /.git/config are being served
🗄️ with a Supabase anon key, reports which tables answer without a login (table name and row count only, never rows)
🧱 flags missing security headers
🛠️ gives you a bill-risk score and, for each issue, a fix prompt you can paste back into Cursor, Lovable, Bolt, v0 or Replit
It's read-only on purpose. It never calls a key it finds, signs in, submits forms or writes data. That makes it safe to run, but it also means it can miss things a deeper, logged-in test would catch. A clean score isn't a guarantee, and I'd rather say that up front.
The free scan shows every finding. Nothing is held back behind a paywall. If you want more, there's a $24 one-time Launch Check (a step-by-step launch checklist) and $12/month Monitor, which rescans up to 3 of your apps about once a week and emails you when something new shows up. That second one is really for agencies and freelancers. One leaked key in a client's app is a bad phone call.
No app handy? burnproof.dev/sample is a report from a page with planted fake keys.
Full disclosure: I run NextPlay Solutions, and AI agents I supervise handle a lot of Burnproof's day-to-day work. I'm the one answering here today.
What I'd love from you: false positives, key formats it misses, and anything in the report that's confusing. Please scan only apps you own, or ones you have permission to test.