Find exposed AI keys.
Paste a config file, a CI workflow, or a chunk of source. KeyOps looks for provider key patterns, masks every value, and tells you what to rotate first. Your text never leaves this tab.
Runs in your browser. Nothing is uploaded.
Audit result
Raw values are masked before they render.
Paste a config, then scan.
You get provider, severity, line number, and a masked key. No account and no server call.
01 / local
No upload.
Detection runs in your browser. There is no API call and no account.
02 / masked
No raw value shown.
Only a short prefix and suffix appear, enough to identify the key.
03 / actionable
Rotate, do not just alert.
Take the finding to the CLI to plan the replacement and rollback.
Want the tracked-file scan?
The CLI scans tracked files, ignored files, and connected platforms. It also writes the rotation plan.