Before you view an HTML file in the browser and then publish it: finds live API keys, localhost URLs, file:// paths, noindex and mixed content left in the page. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
This page is the working piece. The full pack has everything below.
24 rules read the .html file you are about to open in the browser and flag every line that behaves differently once the page has a public URL: live API keys, localhost and file:// paths, htt
In February 2026 a developer reported an $82,000 Google Cloud bill after a key embedded in client-side Google Maps code was taken from the page source; their normal spend was $180 a month.
Buy the full version — $29It reads the HTML file open in your editor and applies 24 rules that describe the gap between a local preview and a public URL. You get a list of findings, each with a severity, the line number, and the fix. On the bundled dirty fixture it reports 27 findings, 15 of them high severity; on the clean version of the same page it reports zero.
Solo web developers, freelancers and indie makers who write a static HTML page locally, check it with View in Browser, then publish that same file to Netlify, GitHub Pages, S3 or a client's shared host. It is aimed at people with no build pipeline and no reviewer, where nothing sits between the preview and the live page.
View Source shows you the page but will not tell you which string is a live credential, which URL only resolves on your machine, or that a noindex tag survived. A chatbot cannot see your file, so it guesses line numbers. Push-time secret scanners run on git, not on an .html you drag onto a host, and none of them check for file:// paths or a stale copyright year.
Free covers the whole job for one file: open the page, run the audit, read every finding with its line and fix. Nothing is held back or watermarked. The paid tier changes scope only. For $29 once, one command audits every HTML file in the workspace and writes a dated LEAK-AUDIT.md you keep. Seven-day full refund.
Finding it afterwards is the expensive path. In February 2026 a developer reported an $82,000 Google Cloud bill after a client-side Maps key was taken from their page source, against a normal spend of $180 a month. GitGuardian counted 28,649,024 new secrets pushed to public repositories in 2025, and found 64% of keys leaked in 2022 were still valid in January 2026.
One question, answered by the person who built it. Your email only if you want the answer sent.