Finds real credentials leaked in your source, env files, client bundles and git history before someone else does.
Scans the working tree and git history for secret-shaped strings, checks which ones reach the browser, and separates live keys from placeholders and intentionally public keys.
1 skills · 2 MCP servers · 4 settings
Secret Exposure Hunter looks for credentials that have leaked into a web app's repository: committed .env files, API keys pasted into source, server-only keys that end up in the browser bundle, tokens printed by console.log, and secrets that were deleted from the tree but still live in git history.
It is built for apps written fast on Next.js, Supabase, Express, Prisma and Vercel. It knows the difference between a Supabase anon key (public by design) and a service_role key (never public), between a placeholder and a live value, and it tells you exactly which keys to rotate first.
It only reads. It needs the filesystem and git MCP servers pointed at the app root, and no network access. Give it the path to the app; optionally list the env var names you know are public so they are not reported as leaks.