Site Watch
Checks your live site on a schedule and reports what broke. Its rule: never edit a page.
Keys Scanner
Searches what your site sends to the browser for secret keys and tells you which to rotate. Its rule: never print a full key.
The ECHO line
Its rule is to show keys only masked, with the file and line, because a key pasted into a chat needs rotating too.
For owners whose site calls an AI, a payment service or a map from the browser. The Keys Scanner searches what your site sends to visitors for known secret-key patterns and lists each hit masked, with the file and line. It separates keys that are public by design from real secrets and tells you what to rotate once the fix is live; rotating, revoking and editing stay with you.
TO BE TESTED — RESULTS WILL BE SHAREDFrom how we run our own AI agent teamSetup: about 15 minStandard5 of 5 free opens left
At a glance
- Searches for known secret-key patterns in everything shipped to the browser.
- Masks every key and names the file and line.
- Rotating, revoking and editing stay with you.
Model fit
Best fit
- Coding agent
Also fits
- Run it yourself (open-weight)
Avoid
- Personal agent (acts for you)
- Everyday assistant
Pattern search is a script's job, so a coding agent that can run a search and mask its output fits best, and a model you run yourself keeps the code on your own machine. Don't paste your site's code into an everyday chat: a key pasted into a chat needs rotating.
Where it runs
- Code and website files
Risk
- Access
- Money
Keys Scanner · RL-WK-02
5 of 5 free opens left- ① Orientation
- ② Permission
- ③ Constraint ★
- ④ Invitation
The paste didn't load. Check your connection and try again.
These are samples. Fill in the [INSERT] blanks and adapt each one to your business.
A pasted role guides the agent. Your tool's settings are what stop an action.
Sample handoff note (fictional business)
Settings that enforce it
- Give it read-only access to the site's files (a read-only or plan mode), with no commit, push or deploy rights.
- Block it from reading server-only secret files; some coding agents let you add a deny rule for a file such as .env.
- Limit network access to loading your own site's public pages. It doesn't need to call any other service.
- Set a hard spend limit with each AI provider whose key your site uses, so an exposed key has a ceiling.
- If your tool can't do one of these, leave that part of the job with a person.
One check before you trust it
In a local copy of your site, add a fake key such as sk_live_ followed by 24 random letters. The scan should list it masked, with the file and line, and change nothing.
Want it set up in your own tools? Book a Working Session · $450Working Sessions run in English or Spanish.