DarnlyFree security tools for vibecoders
AI agents write working code fast, but they can also leave API keys in the frontend, skip security headers or put secrets in files that get committed. These tools help you catch that. Scan a live site for exposed API keys, check its security headers, build a Content Security Policy, and decode a JWT to see what it allows. Make strong secrets, write a safe .env.example, and strip location and camera data from photos before you post them. They point out problems, but fixing them is still up to you.
- API key leak checkerDid I leak an API key? Check your site’s JavaScript for OpenAI, Stripe, Supabase and other secret keys.
- JWT decoderPaste a token and see when it expires, who it’s for and its role, in plain words. Nothing is uploaded.
- EXIF removerSee if your photos show where you live, then remove the location, date and camera info in one click.
- Security headers checkerIs my site’s security set up right? Grade your headers A to F and get a ready file for your host.
- .env.example generatorPaste your .env and get a safe .env.example, with secrets that would leak to the browser flagged in red.
- CSP generatorPaste your site and get a Content Security Policy that allows exactly what it loads, for any host.
- Secret generatorOne click for an AUTH_SECRET, JWT secret, webhook secret, API key, UUID or strong password, ready for your .env.
Questions
Are these tools really free?
Yes. Every tool on darnly.dev is free, with no sign-in and nothing to install. They are made by Darnly, a free Chrome extension and Mac app that turns a bug you see on screen into context your AI coding agent can fix.
I found a leaked API key. What now?
Rotate it first: make a new key in the provider’s dashboard and delete the old one, because anyone may already have copied it. Then move the call that uses it to your server, so the new key never reaches the browser. The API key leak checker gives you these steps and a prompt for your AI agent.
Do these tools make my site secure?
No single check can. They catch common mistakes that AI-built apps make, like exposed keys and missing headers. Your database rules, authentication and server code still need their own review.