Security Intelligence

Find Leaked API Keys
Before Hackers Do

CloviScan catches client-side secret exposure other scanners miss — it renders every page in a real browser and reads the JSON your site actually fetches at runtime to find leaked keys, exposed files, and server weaknesses, then tells you exactly how to fix them. Start free.

Scan My Site Free See a Sample Report

5 layers site · code · server · network · GitHub

Network + DOM we read what your site actually ships

OWASP · CWE every finding mapped & explained

Copy-paste fixes, not just a problem list

example.com

SSL Certificate — Valid, expires 2026-09-14 PASS

Missing HSTS Header — browsers not forced to HTTPS MEDIUM

Hardcoded API key found in /config.js — line 23 CRITICAL

phpMyAdmin exposed at /phpmyadmin HIGH

jQuery 2.1.4 — 12 known CVEs in this version MEDIUM

Security Score

3 critical issues need immediate attention

73 /100

Grade

The Difference

The leak isn't in your HTML.
It's in the JSON you ship to the browser.

Header checkers and most scanners read your static HTML and stop. CloviScan renders every page in a real browser, captures the full network waterfall — every XHR, fetch, and hydration blob (__NEXT_DATA__, __NUXT__, Redux state) — and scans what your app actually sends at runtime. That's where leaked API keys, internal endpoints, and "shipped-but-never-displayed" data hide.

Rendered-DOM scan Network-response capture Hydration-blob walker "Shipped but not displayed" detection

4-Layer Intelligence

From Surface to Source Code

Other scanners check what's visible. CloviScan goes four layers deep — analysing your external footprint, your actual source code, your server configuration, and then showing you exactly how to fix everything it finds.

Layer 1

External Website Audit

Your site's public-facing security profile, examined from the outside — exactly as a security researcher or attacker would see it. No access credentials required.

SSL/TLS certificate validity, grade, and cipher strength
Security headers: CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy
DNS health: SPF, DKIM, DMARC, open resolvers
Exposed admin files: .env, wp-config.php, .git/config
Google Safe Browsing check + IP reputation score

"We check what the internet can already see about you — before someone malicious does."

Website Audit — example.com

SSL Certificate A+ Grade

Content-Security-Policy Missing

HSTS Enabled Pass

.env file exposed Critical

DNS — no DMARC Medium

Safe Browsing Clean

Layer 2 — The Unique One

Static Code Security Analysis

We analyse your actual source files for patterns that indicate future vulnerabilities — not just known CVEs, but the dangerous code habits that create breaches. This is what other scanners skip entirely.

Hardcoded API keys and secrets in source files
SQL injection patterns in query builders and ORMs
XSS-vulnerable input handling (innerHTML, eval, dangerouslySetInnerHTML)
Unprotected CSRF routes and missing token validation
Outdated dependencies with known CVEs via lockfile analysis
Insecure redirects and open redirect vulnerabilities

"We analyse your code like a security researcher would — looking for patterns, not just signatures."

/app/routes/users.js 2 issues

44router.get('/user/:id', async (req, res) => {
45  const id = req.params.id;
46  const result = await
47    db.query(`SELECT * FROM users
      WHERE id=${req.params.id}`);

⚠ SQL Injection Risk on line 47 — string interpolation in query allows attacker to inject arbitrary SQL. Severity: Critical.

📋 Fix: db.query('SELECT * FROM users WHERE id = ?', [req.params.id])

89const API_KEY = "sk-live-4xZ8...";

⚠ Hardcoded API key on line 89 — credential exposed in source file, likely in version control. Severity: Critical.

📋 Fix: Move to environment variable: process.env.API_KEY

Layer 3

Server Hardening Audit

Your server configuration is as important as your code. CloviScan audits the underlying infrastructure — SSH, firewall rules, open ports, and protection services — for dangerous defaults and gaps.

SSH hardening: root login status, port exposure, key-only vs password auth
Firewall rule coverage and unexpected allow rules
Open ports that expose databases, admin panels, or internal tools
Outdated software versions: PHP, Node.js, MySQL, nginx, OpenSSH
Fail2ban, ModSecurity, and intrusion protection status

"A perfectly written app on a misconfigured server is still a sitting target."

Server Audit — 192.168.1.100

SSH root login enabled Critical

SSH key-only auth Good

Port 3306 open (MySQL) High

PHP 7.4 — EOL Jan 2023 Medium

Fail2ban active Good

phpMyAdmin publicly exposed Critical

Layer 4 — Where Others Stop

AI-Powered Autofix

Finding problems is the easy part. CloviScan goes further — every issue comes with a plain-English explanation, copy-paste code fix, and step-by-step server instructions so your team can resolve it today, not next sprint.

Plain-English explanation of every vulnerability found
Copy-paste code fix for all code-level issues
Step-by-step remediation for server and config issues
Auto-apply option for safe, low-risk fixes with one click
Priority scoring so you fix critical issues first
Re-scan confirmation after each fix is applied

"Not just a scanner — a security engineer in your browser."

Issue #1 — Critical SQL Injection

String interpolation in your database query lets an attacker pass SQL commands instead of an ID. This can expose your entire database with a single request.

SUGGESTED FIX — Copy & Paste

db.query(
  'SELECT * FROM users WHERE id = ?',
  [req.params.id]
);

Scan Type · GitHub

GitHub Repository Scan

Point CloviScan at a repo and it scans the code the way a researcher would — including the parts you thought you deleted. Your token stays in memory only, is never logged, and is masked in every result.

Working-tree secret scan + sensitive-file detection + light SAST (eval/exec, hardcoded passwords, SQLi)
Full git-history secret scan — catches secrets removed from HEAD but still recoverable
Dependency CVE scan across your lockfile
Repo hygiene: missing SECURITY.md, .env not git-ignored, no branch protection

"The credential you committed and force-pushed away is still in the history — and bots already have it. We find it first."

GitHub Scan — your-org/your-repo

AWS key in git history (commit a3f9…) Critical

Hardcoded password — auth.py Critical

4 dependencies with known CVEs High

.env not in .gitignore Medium

No secrets in working tree Clean

Why It Matters

A Bug Today is a Breach Tomorrow

Every major breach starts as a small, overlooked code issue. Here's how a hardcoded API key becomes a catastrophic security event — and how CloviScan breaks the chain.

The Hidden Bug

A developer hardcodes an API key directly in a config file. It looks harmless. The test suite passes. The code ships to production.

          const key = "sk-live-4xZ8mN...";
        

The Crawler Finds It

An automated bot scans GitHub repositories and public websites for exposed secrets around the clock. Within hours of your deploy, your API key is being actively tested on the dark web.

Credential detected — 14h ago

The Breach

Attackers use your exposed key to spin up compute instances, exfiltrate your customer database, or send thousands of spam messages — all billed to your account.

Unexpected charge: $14,870 — AWS

CloviScan catches this at Step 1 — before the crawler ever runs.

Scan Your Code Now

Try It Now

Get a Free Security Snapshot

Enter any website to see a sample of what CloviScan finds. No account required.

Your security snapshot will appear here

Scanning …

SSL: Valid certificate — Grade A

Headers: Missing Content-Security-Policy header

Critical: /.env file responding 200 OK — database credentials exposed

Overall Security Grade

3 issues found · 1 critical requires immediate attention

Score

48/100

This is just the snapshot.

Enter your email and we'll run the full deep scan — every page rendered, network + code analysed — and send you a link to your detailed report.

No spam. One report email + the option to monitor your site continuously.

Hardcoded Stripe key in /assets/app.4f2.js — line 1180Critical

Internal admin endpoint leaked in __NEXT_DATA__ payloadCritical

Database hostname exposed in network JSON responseHigh

3 dependencies with known CVEs (lockfile)High

Missing Content-Security-Policy + Permissions-PolicyMedium

14 findings · 2 critical · counts are real

The structure and severities are genuine — only the sensitive details are blurred. Unlock this report once, or subscribe to scan continuously.

Unlock this report Start 7-day trial

Detect → Fix → Protect

Found it. Now fix it — and keep it clean.

Finding the problem is only half the job. Critical and high findings route straight into a fix flow, and continuous monitoring re-scans so a clean site stays clean.

1 · Detect

Five scan layers find the issue and map it to OWASP / CWE with a severity and plain-English impact.

2 · Fix with CloviShield

Critical & high findings get a "Clean & protect with CloviShield" action — guided remediation and hardening, not just advice. Accessibility findings route to CloviAble.

3 · Monitor continuously

Schedule weekly or monthly rescans with alerts on any new finding, so regressions surface before attackers do.

A scan that ends at a problem list is half a tool. CloviScan closes the loop.

Scan, fix & monitor

Where Teams Use It

Catch it before the world does

Pre-launch gate

Scan staging before you go public — block the deploy if a critical disclosure is found.

Before an investor demo

A 60-second checkpoint so nothing embarrassing ships in the JSON during a live demo.

Every release

Re-scan on each deploy and get alerted the moment a new leak or regression appears.

Ecosystem

Security Embedded Across Your Stack

CloviScan feeds its findings into the tools you already use — so security stays on the radar everywhere, not just in a quarterly audit report.

CloviSEO

Security score surfaces inside your SEO audit — HTTPS and headers affect rankings

CloviAble

Security findings appear alongside accessibility issues in the unified site audit

CloviFlow

Auto-alerts and remediation workflows trigger on new critical findings

aaPanel

Server hardening audit pulls live data from your panel — no manual SSH needed

Debug Agent

Code autofix agent applies suggested patches from scan results automatically

Pricing

Try any plan free for 7 days

Keep it or cancel before day 7. When the trial ends it converts to the same plan you signed up for. All plans include AI-powered remediation advice — not just a list of problems.

Lite

For individual developers

$19

per month, billed monthly

3 domains monitored
Weekly scans
SSL/TLS certificate monitoring
Basic SEO audit
PDF scan reports
Email alerts
DMARC / DKIM / SPF audit
Continuous monitoring

Start 7-day trial

then $19/mo · cancel anytime

Why Teams Choose CloviScan

Most tools read your static HTML and stop, or flag problems they can't help you fix. CloviScan reads what your site actually ships at runtime, finds leaked secrets and internal exposure others miss, and fixes them reversibly — at an SMB price.

Reads the JSON your page fetches, not just the HTML

Renders every page in a real browser and scans the runtime network responses — the API keys and secrets static scanners never see. ✅ Built

Internal-architecture disclosure detection

Surfaces leaked ports, paths, IPs and internal services — catch it before the world does. ✅ Built

Scan AND fix, reversibly

Quarantine and restore with a never-delete guarantee — not a detect-only report you're left to act on alone. ✅ Built

Code + git-history secret scanning

Scans your source and full git history alongside the live site — catches secrets removed from HEAD but still recoverable. ✅ Built

AI-researched findings with provenance

Findings are marked RESEARCHED vs ASSUMED and cited — real, verifiable context, not inflated rule dumps. ✅ Built

Pre-deploy / CI gate

Block the deploy on a critical leak — stop the secret before it ever ships. ✅ Built

Scan everything you connect

Extend the same deep scanning to your email, cloud and SaaS connections. 🔜 Coming

Enterprise DAST (costly) · Free header checkers (no fix) · CloviScan (deep + AI fix + SMB price)

Feature	CloviScan	Package / CVE scanners	DAST tools	Header scanners
External website audit	✓	Partial	✓	✓
Static code analysis	✓	✓	—	—
Server hardening audit	✓	—	Partial	—
AI-powered autofix	✓	Partial	—	—
Copy-paste code fixes	✓	—	—	—
SMB-friendly pricing	✓ from $19	Often $$$	Enterprise pricing	Free (limited)
Free trial / sample	✓ 7-day trial + sample scan	✓ Limited	—	✓ Headers only
Clovi ecosystem integration	✓ Native	—	—	—