KeyLeak Detector Bloghttps://keyleakdetector.com/blogRuntime secret scanning, API key leaks, and BaaS (Supabase/Firebase) security.en-usFri, 29 May 2026 09:00:00 +0000The Key Your Scanner Swore Wasn't Therehttps://keyleakdetector.com/blog/why-runtime-secret-scanning-mattershttps://keyleakdetector.com/blog/why-runtime-secret-scanning-mattersFri, 29 May 2026 09:00:00 +0000I built KeyLeak Detector after watching a live Stripe sk_live_ secret key get pulled out of an app whose GitLeaks, TruffleHog, and GitHub scans were all green — because none of those scanners were ever built to look at the running app.The Public Key Was Never the Problem: Why Vibe-Coded Apps Leakhttps://keyleakdetector.com/blog/baas-security-risks-vibecoded-appshttps://keyleakdetector.com/blog/baas-security-risks-vibecoded-appsFri, 29 May 2026 09:00:00 +0000I kept watching AI-built apps ship with the database door wide open, so I started probing RLS before every deploy instead of trusting the config — here's the pattern and how I check for it.