Secrets Exposure Check

Scans project config files for hardcoded secrets before you deploy.

Overview

Scans project config files for hardcoded secrets before you deploy. Fetches top-level config files (.env*, wrangler.toml, vercel.json, next.config.*, package.json, etc.) and scans for hardcoded AWS/OpenAI/Anthropic/Stripe/GitHub keys, private keys, DB URLs with passwords, JWT secrets, weak values in .env.example, and server-only env vars accidentally exposed via NEXT_PUBLIC_. Returns 0-100 score, per-finding kind/severity/path/line/redacted-evidence/recommendation, and a Venice plain-English verdict. Dual input: {repo: 'owner/name'} for public GitHub or {files: [{path, content}, ...]} for private / agent-workspace use. Use it as a secrets exposure scan, hardcoded API key detector, .env-committed-key audit, Next.js client env leak detector, or pre-deploy secret gate.

Endpoint

Method	Endpoint	Price	Description
POST	/v1/marketplace/api/secrets-exposure-check	$0.023	Invoke Secrets Exposure Check (Code) and return the upstream response.

How to call it

Requests are paid per call over the x402 protocol. Call the endpoint, receive a 402 Payment Required quote, then repeat the request with the signed payment header. The SDKs do both steps for you.

# 1. Ask for a quote
curl -i -X POST https://api.jarvisclaw.ai/v1/marketplace/api/secrets-exposure-check \
  -H 'Content-Type: application/json' \
  -d '{}'

# 2. Pay it (the SDK signs and retries for you)
curl -X POST https://api.jarvisclaw.ai/v1/marketplace/api/secrets-exposure-check \
  -H 'Content-Type: application/json' \
  -H 'X-PAYMENT: <signed-payload>' \
  -d '{}'

Open in the marketplace