# Pre-launch security prompts for vibe-coded apps: Key Leak Pre-Check (free sample)

> From the pre-launch security prompts: find the three key leaks AI-built apps make most, before launch. An env file git was never told to skip, a secret behind a NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_ name, and live keys pasted into code, each printed masked. Then a drafted rotation plan, your yes recorded at your own terminal, and a launch gate that needs a clean rescan.

- URL: https://paperchasewebb.ai/bots/marketplace/items/key-leak-pre-check-free-sample/
- Type: Prompt pack
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); One Python script, a settings template, a made-up booking app before and after the fixes, and agent rules for each harness. Tested on Linux
- Price: Free USD
- Difficulty: Beginner
- Setup time: 5 min
- Time to result: About five minutes
- Format: Markdown (.md) file, key-leak-pre-check-free-sample.md
- Version: 1.0, updated 2026-11-04
- License: Personal and commercial use.

## What you end up with

Every exposed key found, rotated and cleaned up before the first stranger opens your app.

## What you get

- Env files git tracks, or that .gitignore does not cover, and a .gitignore with no .env rule
- Secrets behind a public prefix: NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_, REACT_APP_, NUXT_PUBLIC_ or PUBLIC_
- Stripe, AWS, GitHub, Slack and AI provider keys in code, and private key blocks, always printed masked
- A drafted rotation plan with one row per finding, and a check that every row is closed and no key was pasted in
- Your yes at your own terminal, refused in agent sessions, and a launch gate that needs an unchanged plan and a clean rescan
- AGENTS.md, CLAUDE.md, a Grok Bot standing order, a Hermes skill and 25 tests

## Who it is for

Anyone about to launch an app built with an AI coding tool who has never checked what their repo and browser bundle give away.

## Tools needed

- Python 3.8 or newer: keycheck.py: four read-only source checks with masked output, a drafted rotation plan, a plan check, owner yes and a launch gate; standard library only; never logs in, rotates a key or calls a provider
- Grok Bot, Claude Code, Codex or Hermes (optional): runs the scan, drafts the plan and proposes code fixes as diffs under AGENTS.md; never rotates a key, approves or deploys
- You need: Python 3.8 or newer
- You need: Your app's source folder

Cost to run: Free. Python is free.

## How it works

1. **Run the example.** Unpack the file and, inside example/, run python3 ../keycheck.py scan app findings.json. Expected: Six findings, including a service key behind NEXT_PUBLIC_ and a live Stripe key in checkout.js, all masked.
2. **Scan your app.** Copy keycheck.py and templates/settings.json into your app folder, put your name in settings.json and run python3 keycheck.py scan . drafts/findings.json. Expected: Every finding with a file and line.
3. **Rotate, then clean up.** Run plan to draft drafts/rotation.md. Make new keys in each provider's dashboard and turn off the old ones; your agent proposes the code fixes as diffs. Fill in each Done line yourself. Expected: planchk passes.
4. **Approve and launch.** Run python3 keycheck.py approve settings.json drafts/rotation.md drafts/findings.json and type rotated, then run gate before you launch. Expected: gate says GO only with an unchanged plan and a clean rescan.

## Sample prompt: Check my app for leaked keys (Grok Bot, Claude Code, Codex, Hermes)

```
Follow AGENTS.md. Run keycheck.py scan on this folder, then plan to drafts/rotation.md. For each finding, tell me which dashboard to rotate the key in and propose the code fix as a diff. Never print a full key.
Show me the plan and the diffs, then stop. Never rotate a key, approve the plan, commit or deploy.
```

The script and the agent files are in the file.

## Free preview of key-leak-pre-check-free-sample.md

````markdown
# Key Leak Pre-Check

**Most leaked keys in AI-built apps are not clever hacks. They are a .env file git was never told to skip, a service key behind a NEXT_PUBLIC_ name, or a live Stripe key pasted into a file to get checkout working. This free sample finds those three in your source before launch, drafts the rotation list, and holds launch until you confirm every key is rotated.**

Version 1.0, 2026-11-04. By PaperChaseWebb Inc. Free sample of Pre-launch security prompts for vibe-coded apps ($19). Works with Grok Bot, Claude Code, Codex and Hermes, or by hand. Python 3.8 or newer, no installs. Any stack: Next.js, Vite, Expo, Create React App, SvelteKit, Python and more.

## What you get out of it

- Four read-only checks on your app folder:
  - env files git tracks (in a git repo), or that .gitignore does not cover
  - secrets behind a public prefix: NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_, REACT_APP_, NUXT_PUBLIC_ or PUBLIC_ on a name that says SECRET, SERVICE_ROLE, PRIVATE or PASSWORD
  - secret-shaped strings in code: Stripe, AWS, GitHub, Slack and AI provider keys, and private key blocks
  - a .gitignore with no rule for .env or .env.local
- Every secret printed masked: the first seven characters and the length, never the key.
- A drafted rotation plan, one row per finding, with the fix in plain words.
- A plan check: every finding has a row, every Done line is filled in, and no key was pasted into the plan.
- Your yes, recorded at your own terminal, and a launch gate that sa
````

## Test record

- Date: Nov 4, 2026
- What was run: tests/test_keycheck.py (25 tests) unpacked from the sample file and run fresh on Linux, Python 3.8, 3.9, 3.11, 3.12 and 3.13; scan, plan, planchk, approve and gate on the made-up example.
- Result: 25 passed, 0 failed on all five versions; the example app fails six ways with masked keys and the fixed app scans clean; a tracked env file is caught in a git repo; placeholders in .env.example pass; the plan check catches missing rows, open rows and a pasted key; the yes is refused in agent sessions, without a terminal, for the wrong name, without the typed word and for a plan with open rows; an edit after the yes or a new leak makes the gate say NO-GO.
- Not run: macOS or Windows. A real production app. A live Grok Bot, Claude Code, Codex or Hermes session.

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- The sample reads source files. Decoding keys inside a built bundle, the row level security test that logs in as a stranger, storage buckets, webhooks and the 14 prompts are in the full pack.
- Pattern checks can miss a key with an unusual shape and can flag a test string. Deleting a key from code does not remove it from git history; rotating it does.
- On 2026-11-04: 25 tests passed on Python 3.8, 3.9, 3.11, 3.12 and 3.13 on Linux, run from the files unpacked out of the sample. Agent rules guide; they were not loaded inside each harness for this release.

## Questions

**Does it send my keys anywhere?** No. It reads your source folder on your own machine, prints every secret masked and writes two local files. It never logs in, calls a provider or rotates a key.

**Can my agent approve the plan?** No. The yes is refused inside an agent session, without a terminal, for a plan with open rows and for anyone but the owner in settings.json.

**What is in the full pack?** 14 prompts for keys, row level security, buckets, webhooks, model keys and headers, a read-only rls_check.sql that logs in as the public key and as a second user, and bundle_scan.py for your production build. $19.

## How to get it

Free sample. Download it directly at https://paperchasewebb.ai/bots/marketplace/items/key-leak-pre-check-free-sample/, no signup.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com