Local-first · no keys uploaded · no account required

Stop a leaked key before it becomes an invoice.

Audit pasted code, provider restrictions and budget controls entirely in your browser. Get a prioritized containment plan in under a minute.

Run the free risk scan See why this exists

141public pages checked

24markets covered

25price or loss signals

THE PROBLEM

Alerts tell you the fire started. Hard controls keep it small.

Developers repeatedly report missing spend ceilings, browser-exposed keys and service-account abuse. Native controls are improving, but they differ by provider and can still leave gaps.

Abstract OpenAI risk surface symbol — OpenAI key and project-control risk surface

Abstract Anthropic risk surface symbol — Anthropic secret and spend-control risk surface

Abstract Google Gemini risk surface symbol — Google Gemini key-restriction risk surface

Solo builder checking a local prototype

Small team reviewing shared API controls

Operations owner validating budget safeguards

FREE LOCAL DIAGNOSTIC

Find the weakest link in your API bill controls.

Paste only code or configuration you are allowed to inspect. Analysis happens locally in this tab; nothing is transmitted.

No upload and no analytics tracker
Known secret prefixes are masked in the report
Exportable remediation plan

CONTAINMENT, NOT PANIC

Rotate. Restrict. Cap. Revoke. Prove.

A useful response is ordered: stop exposure, remove old credentials, enforce provider restrictions, test the ceiling, then preserve an audit trail.

BUDGET BUFFER

Know how close you are to the line.

Model a conservative emergency buffer. This does not replace provider billing data, but it makes an alert-only setup visible.

PUBLIC EVIDENCE

Built from real losses, requests and counterevidence.

We do not claim every provider lacks controls. Google introduced spend caps and tightened unrestricted keys; self-hosted alternatives exist. The gap is consistent, low-ops protection across providers.

2026-07-02 · Google AI Developers ForumService-account abuse reported at $17k in three hours OpenAI Developer CommunityDevelopers request project hard limits, not alerts alone 2026-07-05 · Indie HackersA surprise Anthropic bill triggered an in-workflow cost tool Counterevidence · GoogleNative project spend caps reduce, but do not erase, the gap

HONEST LIMITS

This scanner cannot shut down your provider account.

Static, local analysis

It detects risky patterns and configuration gaps, not live account activity.

Rotate exposed secrets

Masking a key in code is not enough. Revoke it at the provider.

Test native controls

Provider limits, delays and account behavior change. Verify them directly.

Make the next invoice boring.

Run the local scan now. Monitoring automation is in private beta and is not accepting payments yet.

Scan my setup Join monitoring beta

Questions people actually ask真实会被问到的问题

Do I have to upload my API keys?我需要上传我的 API 密钥吗？

No. The check runs in your browser and nothing you paste is transmitted to us. Never paste a live secret into any website, including this one — redact it first.不需要。检查在你的浏览器里运行，你粘贴的任何内容都不会传给我们。永远不要把生效的密钥粘进任何网站，包括本站——先脱敏。

What does it actually check?它到底检查什么？

Whether keys appear in client-reachable code, whether provider-side restrictions and spend caps are configured, and whether a leak would be noticed before billing closes.密钥是否出现在客户端可触及的代码里、供应商侧的限制与花费上限是否配好，以及一旦泄露能否在账单结算前被发现。

Is it free?免费吗？

Yes. There is no paid tier on this tool.免费。这个工具没有付费档。