leaked keys
Has your AI-generated code leaked an API key?
Run the free nittim Scan on your repo. It reads your code as it stands now and flags API keys and other secrets it finds. It doesn't read past commits, a built bundle or your provider's usage, so a clean result isn't the last step.
What the free Scan reads
- Committed secrets in your code as it stands now, including API keys.
- Dependencies with known vulnerabilities.
- A public or connected repo. No card and no sign-in.
If it finds a key
- Rotate the key first
- Make a new key at your provider and retire the old one. Treat the old key as public from now on.
- Remove it from the code
- Move the new key into an environment variable or your host's secret store, then commit the fix.
- Purge it from history
- A deleted key still sits in your past commits. Rewrite the history, or start a clean repo, once the old key is dead.
What it can't tell you
nittim reads your code as it stands now. A clean Scan doesn't cover:
- Past commits. A key committed and later deleted isn't found.
- A built bundle. A key baked into shipped JavaScript isn't read.
- Your provider's usage. Look at your provider's dashboard for calls you don't recognize.
- Other branches. It reads one branch, your default unless you link to another.
- Every key. The Scan can miss one, so a clean Scan doesn't prove there are none.
If a key ever sat in your repo, even briefly, rotate it. To check a built site, open its source and search for the start of your key, and keep secret keys on the server.
Scan, Loop, Audit and Full Audit
- Scan
- Free, with no card and no sign-in. Looks for committed secrets and dependencies with known vulnerabilities.
- Loop
- A checklist your own assistant runs, where your code already is. Free to run: nittim charges nothing and receives nothing of your code. Your assistant's own usage still applies.
- Audit
- A review of the code that matters most. A GitHub or Google account gets its first Audit free. After that, $29 buys 5 Audits.
- Full Audit
- The same review across every eligible source file. Priced by the size of your repo, and you see the price first.
Run the Loop · See the benchmark
Checking more than keys? See how to check an AI-built app before you launch.
Common questions
How do I find out if my AI-generated code has leaked API keys?
Run the free nittim Scan on your repo. It reads your code as it stands now and flags API keys and other secrets it finds. It doesn't read past commits, a built bundle or your provider's usage, so a clean result isn't the last step.
Does the Scan find every leaked key?
No. It can miss a key, so a clean Scan doesn't prove there are none. It reads the code as it stands now. A key committed and later deleted isn't detected, and neither is a key in a built bundle.
What do I do if it finds a key?
Rotate the key first, then remove it from the code, then purge it from your git history.
Does it replace a penetration test?
No. nittim is advisory. It doesn't replace a penetration test or a qualified professional. A human review is a different service.
How much does it cost?
The Scan is free. A GitHub or Google account gets its first Audit free. After that, $29 buys 5 Audits.
How long does an Audit take?
Usually within 15 minutes. Worst case, 24 hours.
What happens to my code?
The Scan: Files leave your machine and are read in nittim's server memory. No model, no verdict. Kept: your report, with the line each finding points at — off by setting. The Loop: Nothing of your code is sent to nittim. Your assistant runs it where it already works. Anonymised counts only, and only if you choose. An Audit reads a digest of your source. The digest goes to Anthropic on nittim's key, kept up to 30 days. Bring your own key and it goes to your account.