Did your AI-built app leak its keys?
Built with Lovable, Bolt, Cursor, v0 or Claude Code? Paste the GitHub repo. GitGhost finds API keys in the code, secrets anyone can read in your website, Supabase admin keys and .env files, then gives it a grade.
·
| File | What it looks like | Why | Preview |
|---|
Show off your grade
Stop leaks before they happen
Install GitGhost once and it checks every git commit automatically. If you're about to commit a key, it blocks the commit.
pip install git+https://github.com/pzr6m/gitghostcd your-project && gitghost installHow the grade works
Every repo starts at 100. A Supabase admin key or a private key block costs 60 points. Each leaked key in a known format (OpenAI, AWS, Stripe, GitHub…) or a committed .env/key file costs 40. A secret in a public variable (NEXT_PUBLIC_, VITE_…) costs 30, and a hardcoded password costs 25. Random-looking strings that might be secrets cost 5 each, up to 20, so they alone can't drop a repo below B.
A+ 100 · A 90+ · B 75+ · C 60+ · D 40+ · F below 40
It checks the current files on the default branch. Keys deleted in a later commit are still in git history; to check those, install GitGhost and run gitghost scan --history. Very large repos are sampled (up to 400 files, config files first). Lines marked gitghost:ignore and paths in .gitghostignore are skipped.