Will It Vibe?SendGrid API key
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 25 points from that category, once per scan, no matter how many places it turns up.
What it detects
A SendGrid API key (SG.<id>.<secret>) was found. It can send mail from your account and, with full access, manage the account.
Why it matters
A SendGrid API key can send mail from your account and, with full access, manage the account itself. A leak lets attackers send phishing or spam from your verified domain, damaging deliverability and reputation. The key stays valid until revoked.
How to fix it
Move the key into an environment variable and read it at runtime. Delete the exposed key in the SendGrid dashboard and create a new one with only Mail Send permission. Never ship it to the client.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo