Find exposed AWS access keys before hackers do

Continuously monitor your domains, APIs, public JavaScript, and exposed services. Every run shows you what changed since the last one.

surfacedrift.com/overview

Overview

acme.com · 5 root domains · 218 assets

DoneUpdated 2m ago

Domains55 / 5 on plan

Checks12812 today

Priority issues32 critical · 1 high

Review queue71 running · 0 stale

Recent findings

Severity	Finding	Asset	Seen
Critical	Exposed .env with live database URL	api.acme.com/.env	4m ago
Critical	Auth bypass: API accepts JWT alg:none	api.acme.com/v1/auth	9m ago
Medium	Undocumented admin API reachable	api.acme.com/internal/v2	1h ago
Medium	Staging host publicly resolvable	staging.acme.com	3h ago
Low	Security headers missing on CDN host	cdn.acme.com	1d ago

Vulnerabilities

9 open across acme.com

2 critical

Open issues

Severity	Issue	Asset	State
Critical	Exposed .env with live database URL	api.acme.com/.env	Open
Critical	Auth bypass: API accepts JWT alg:none	api.acme.com/v1/auth	Open
High	Admin panel reachable without auth	admin.acme.com	Open
High	Subdomain takeover candidate	blog.acme.com	Triaging
Medium	Undocumented admin API reachable	api.acme.com/internal/v2	Open
Medium	Staging host publicly resolvable	staging.acme.com	Triaging

Hack Agent

Ask about exposure changes and what to fix next

Workspace context

What changed since the last check on acme.com?

Ask about exposure changes…

Secrets

5 exposed in public assets on acme.com

1 high

Exposed secrets

Severity	Secret	Source
High	AWS access key (long-lived IAM)AKIAQ4F7XKZ2NB6QF3J · wJalrXUtnFEMI…bPxRfiCY	/assets/config.4c2.js
Medium	Supabase anon keysb_pub_3f9a1c7e…e21	/assets/vendor.4c2.js
Medium	Stripe webhook secretwhsec_9c41…2d	/api/checkout.js
Low	Sentry DSNhttps://a1b2c3…@o42.ingest.sentry.io	/assets/app.8f1c.js
Low	Google Maps API keyAIzaSyB7…Xk	/index.html

Built by a hacker who’s discovered & reported vulnerabilities to

Trademarks belong to their respective owners. Listed organizations run vulnerability disclosure programs where issues were responsibly reported. This is not an endorsement or partnership.

01See what changed

New secrets, routes, and services land in their own bucket, apart from the stuff you already knew about.

02Open the evidence

Every finding points at the host it came from, the file, and the exact line that tripped it.

03Hand off the fix

Mark it triaged, export the PDF, and re-check the host the moment the fix ships.

The review loop

A security review that reruns itself

Routes, client config, and JavaScript ship faster than anyone reviews them by hand. Every run re-checks your approved domains and boils it down to the four things that actually decide whether you're exposed.

Change detection

Every run is a diff, not a dump

Each run compares what's live now against the last one and shows you only what moved. Then it drops the changes that don't carry security weight, so you're not rereading a wall of findings you already cleared.

Weekly on Monitor, daily on Pro and Scale
New and changed surface split from known-good
Root-domain scope set by your plan

Secrets

Leaked keys, with the file that leaked them

AWS keys, Supabase and Firebase config, webhook secrets, DSNs, and decoded JWTs. Each one is pinned to the exact bundle, source map, or line it came from, so handoff is a link instead of a hunt.

Source file and matched context on every hit
Decoded JWT previews with risky-claim flags
Weak signing-secret checks on Pro and Scale

Reachable surface

The endpoints that matter, minus the noise

New API routes, GraphQL, admin panels, staging hosts, and open ports. The reachable surface an attacker would find, pulled out of the CDN and image noise a scanner usually buries it under.

New surface flagged the first run it appears
Reachable services and sensitive ports
Broader validation on Scale

Handoff

A queue you can hand to whoever owns the fix

Every finding carries severity, evidence, and owner-ready fix steps. Triage states, PDF export, and a one-click recheck against just that host prove the fix actually landed, with no spreadsheet in the loop.

Owner-ready fix packets
Exportable PDF evidence on every finding
Recheck history proves the fix held

Pricing

Know where your app is exposed and what to fix first.

Every plan watches your live app and tells you what actually needs fixing, not just what changed.

Monitor

Best first plan

$99/mo

For founders watching a single live product.

5 root domains, re-checked weekly
Secrets in JavaScript, source maps, and client config, each tied to the file it leaked from
New API routes, admin and staging surfaces, open ports, and TLS/DNS/header drift
AI agent that explains what changed and what to fix first
Every finding ships with evidence, severity, and owner-ready fix steps
Email alerts, triage states, change history, and one-click rechecks

Unlock full review

Pro

Daily drift

$199/mo

For teams that ship often and need daily checks.

15 root domains, re-checked daily
Everything in Monitor, with deeper endpoint validation on every run
JWT claim and weak-signing-secret audits, plus risky client-side token usage
CVE and tech-stack exposure hints mapped back to the hosts they affect
Alerts to Slack, Telegram, webhooks, or email, with shared triage

Start Pro

Scale

Broader validation

$499/mo

For bigger surfaces that need more domains and deeper checks.

40 root domains with priority daily checks
Everything in Pro, run across your full scope
Broader service and exposure validation on larger environments
Higher-capacity triage queue built for multi-domain teams and launches
Monthly exposure summary written for leadership and engineering owners

Choose Scale

Surface Drift

Find out what your app is leaking right now.

Start monitoring my domains