Questions before you paste a URL.

A provider key ends up in the JavaScript a coding agent shipped to the browser. Someone copies it and uses it. The invoice goes to the project that owns the key, often with no warning until the bill is already large.

No. Burnproof fetches the public page and a few same-origin scripts. It does not call OpenAI, Anthropic, Gemini, Stripe, AWS, or your database with a key it finds. It does not sign in, submit forms, or change data.

Findings show a masked value: the first four characters, a gap, and the last four. The raw secret is not written into the report. If a real key showed up, rotate it. Removing it from the repo does not un-leak a bundle that already shipped.

One public URL you confirm you own. You get the bill-risk score, every masked finding and its severity, a fix prompt, missing security headers, a check that /.env and /.git/config are not being served, and a safe Supabase anon-key check that reports a table name and a row count, never the rows. The free scan does not hold findings or prompts back for a paid plan.

After Polar confirms payment, the access page shows a checklist for that checkout email. The checklist is the same for every purchase: rotate any key a scan masked, move provider keys out of the browser, confirm /.env and /.git/config are not being served, and run the ownership check before you scan again. Launch Check does not run a scan, hide the free report, write a private review, watch the app, or include a month of Monitor.

Monitor is $12 a month. The access page lets that checkout email save up to 3 app URLs. About once a week, Burnproof runs the same read-only public scan on each saved URL and keeps the result. New findings are emailed to that address from alerts@burnproof.dev after the weekly rescan. The first scan of a URL is a baseline and does not send an alert. The owner-verified scan is still available without paying.

Agency is $49 a month for freelancers and agencies. The access page lets that checkout email save up to 10 client app URLs. The weekly re-scan is the same read-only public check as Monitor. Each scan has a client-ready report link. The page still says Burnproof. It is not a white-label export. New findings are emailed to the checkout address from alerts@burnproof.dev after the weekly rescan. The $150–350 figure on the agencies page is a price you can charge your client. Burnproof does not bill that client and does not take a cut.

Launch Check, Monitor, and Agency open Polar checkout when that plan's link is set. If a link is missing, the button saves a waitlist email and does not charge a card. Burnproof does not see your card number. After Polar notifies us, open Access and enter the same email you used at checkout. That page is not a login. Cancel a subscription with Polar.

On the verify page, Burnproof gives you a token. Put it in a meta tag named burnproof-verify, or in a file at /.well-known/burnproof.txt. When either proof is on the same host, the next scan can read more scripts and the report is marked owner verified. It is still read-only.

If Monitor or Agency is active, the weekly rescan compares the new result with the last one. New findings are emailed to the checkout address from alerts@burnproof.dev. The message lists the issue and a link to the report. It does not include the raw secret. The first scan of a URL is only a baseline.

NextPlay Solutions operates Burnproof. Questions about privacy go to privacy@burnproof.dev. Other questions go to hello@burnproof.dev.