Did a breach just take your API keys?
Paste your .env files, configs, repo text or logs. Shield finds leaked LLM & cloud keys, rates what each one can burn, and builds the fix — a rotation checklist in burn order and a spend fence for the replacements. 100% local: nothing you paste ever leaves this device.
ZERO NETWORK
The scanner makes no network calls. Open your dev tools and watch — your secrets stay on this machine.
NEVER STORED
No uploads, no logs, no analytics on pasted content. Close the tab and it is gone.
NO KEY TESTING
Shield never validates a key against a live provider. Detection is pattern + entropy analysis, done locally.
COMPUTED, NOT QUIZ
Real findings with line numbers and blast-radius ratings — not a self-report checklist.
Why now — the last seven days
- Oct 17, 2026 — OpenCode disclosed a breach of a legacy Console system that exposed OpenAI, Anthropic and Google keys saved by 1.4% of its users. Users reported unauthorized charges from $168 to roughly $1,700 overnight.
- Oct 21, 2026 — LiteLLM confirmed a supply-chain attack: a malicious v1.107.0 release stole cloud credentials and AI API keys. Investigators believe the attackers lifted engineers' tokens out of gateway logs — your logs are a credential store.
- The cap that doesn't exist: none of OpenAI, Anthropic or Google caps spend per API key. Caps live at project, workspace or billing-account level — so a stolen key burns until the container cap trips.
1 · Scan
Paste material or drop files (.env, configs, CI logs, gateway logs, shell history, repo text). Everything is read locally in your browser.
3 · The fix — Pro, $19 one-time
Free scan shows what leaked and what it can burn. Pro builds the response: rotation in burn order, a spend fence sized to your budget, a key-proxy template, an incident report, plus re-scan diff and baselines, a commit-hook and CI pack, SARIF export for GitHub, redacted copies, a canary placement plan and history clean-up commands.
No keys, no setup: when checkout completes, Stripe brings you straight back here with Pro unlocked on this device. Bookmark the page you land on to unlock another device.
Rotation checklist — burn order
Spend-fence generator
Budget-gate proxy (Cloudflare Worker)
One fence per provider found in your scan, sized from your budget above. Real keys live as Worker secrets, never in the code. Each fence has its own inbound token, an atomic monthly cap checked before every call, a per-minute limit and a kill switch. Streaming is refused because it cannot be metered. Needs a Durable Object: see the wrangler.toml at the top of the file. Not tested against your account, so test one fence before you rely on it.
Incident report
Masked findings, blast radius, rotation and fence plan — the document you hand to a client, a boss, or an auditor.
Re-scan diff & baseline
Scan again after you rotate and clean up: see what is resolved, still present or new. Save a baseline (masked fingerprints only, no secrets) to compare against later, or load one from last week.
Where it leaked
Stop the next leak — commit + CI pack
Generated here from the same rules that just scanned. Python 3 only, no installs, never prints a secret value, honors keyleak:allow. Put check.py in .shield/, install the hook, add the workflow.
GitHub code-scanning export (SARIF)
Upload the file to GitHub's Security tab or any SARIF viewer. Findings carry masked values only.
Safe-to-share copies
Your loaded material with every detected secret replaced by a <REDACTED:...> tag, one file per source. Safe for tickets, chats and AI tools.
Canary placement plan
Clean the git history
Only after the keys are revoked.
Too big to DIY? $750 — 72-Hour Key Hygiene Audit
Agencies and small SaaS: we run Shield across your repos, logs and client projects, rotate with you, and fence every replacement. Delivered in 72 hours.
Book the audit