# KeyGuard

> Free scanner by Global McLien Software Solutions that checks any web app, PWA, or website for exposed API keys and secrets visible in the browser. Paste in a URL, get a masked report of what was found, and plain-English steps to fix it. No login or install required.

KeyGuard exists because a large share of AI-assisted ("vibe-coded") and no-code web apps ship secret API keys straight into the browser bundle. Anyone can find them via the browser's DevTools Network tab in about ten seconds. KeyGuard automates that same check — it only requests the HTML and JavaScript a normal visitor's browser already downloads, never logs in, never guesses hidden paths, and never uses or stores a full key it finds (only a masked version).

## What it checks for

- OpenAI API keys (`sk-`)
- Stripe secret/restricted keys (`sk_live_`, `rk_live_`)
- AWS access keys (`AKIA...`)
- Slack tokens (`xox...`)
- GitHub tokens (`ghp_...` and similar)
- SendGrid, Mailgun, and Twilio keys
- Generic hardcoded bearer tokens and `*_SECRET` / `*_API_KEY` assignments

## How it works

1. Visitor pastes in a website or app URL.
2. KeyGuard fetches that page's public HTML and up to 10 linked JavaScript files — the same assets any browser visit downloads.
3. It pattern-matches known secret shapes and returns a free risk summary.
4. Entering a name and email unlocks the full masked findings report with a fix tip per finding.

## Who it's for

Founders, indie developers, and teams who built a web app, PWA, or piece of software quickly — especially with AI page builders or no-code tools — and want a fast, free check for one of the most common and costly mistakes in that workflow: a secret key shipped to the browser.

## Provider

Global McLien Software Solutions — contact: afeez20@gmail.com

## Pages

- [Homepage / scanner](https://keyguard.globalmclien.com/): free scan tool, risk explanation, how-it-works, FAQ.

Note: replace https://keyguard.globalmclien.com/ above with the real production domain once deployed.