FREE SCAN

Did a breach just take your API keys?

Paste your .env files, configs, repo text or logs. Shield finds leaked LLM & cloud keys, rates what each one can burn, and builds the fix — a rotation checklist in burn order and a spend fence for the replacements. 100% local: nothing you paste ever leaves this device.

Scan my material

ZERO NETWORK

The scanner makes no network calls. Open your dev tools and watch — your secrets stay on this machine.

NEVER STORED

No uploads, no logs, no analytics on pasted content. Close the tab and it is gone.

NO KEY TESTING

Shield never validates a key against a live provider. Detection is pattern + entropy analysis, done locally.

COMPUTED, NOT QUIZ

Real findings with line numbers and blast-radius ratings — not a self-report checklist.

Why now — the last seven days

  • Oct 17, 2026 — OpenCode disclosed a breach of a legacy Console system that exposed OpenAI, Anthropic and Google keys saved by 1.4% of its users. Users reported unauthorized charges from $168 to roughly $1,700 overnight.
  • Oct 21, 2026 — LiteLLM confirmed a supply-chain attack: a malicious v1.107.0 release stole cloud credentials and AI API keys. Investigators believe the attackers lifted engineers' tokens out of gateway logs — your logs are a credential store.
  • The cap that doesn't exist: none of OpenAI, Anthropic or Google caps spend per API key. Caps live at project, workspace or billing-account level — so a stolen key burns until the container cap trips.

1 · Scan

Paste material or drop files (.env, configs, CI logs, gateway logs, shell history, repo text). Everything is read locally in your browser.

Treat pasted secrets as radioactive. Anything you paste into any tool — including this one — should be considered exposed and rotated. Shield reduces the blast radius; rotation is the cure.
Drop files here, or

3 · The fix — Pro, $19 one-time

Free scan shows what leaked and what it can burn. Pro builds the response: rotation in burn order, a spend fence sized to your budget, a self-hosted key-proxy template, and an exportable incident report.

Rotation checklist — burn order

    Spend-fence generator

    Key-proxy template (Cloudflare Worker)

    Real keys live server-side in the Worker. Your tools get short-lived, capped, revocable tokens. Self-host it — your keys never touch this page.

    
        
    
          
          
        
    
        
    Incident report
    
        
    Masked findings, blast radius, rotation and fence plan — the document you hand to a client, a boss, or an auditor.
    
        
      
    
      
    
        
    🔒
    
        
    Pro is locked.
    Run a scan, then unlock to generate your rotation checklist, spend fence, proxy template and report.
    
        
      
    
    
    
    
    
      
    Too big to DIY? $750 — 72-Hour Key Hygiene Audit
    
      
    Agencies and small SaaS: we run Shield across your repos, logs and client projects, rotate with you, and fence every replacement. Delivered in 72 hours.
    
      Book the audit