Will It Vibe?Mailgun API key
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
A Mailgun private API key (key-<32 hex>) was found. It can send mail and read logs for your Mailgun domains.
Why it matters
A Mailgun private API key can send mail and read logs for your Mailgun domains. A leak enables spam and phishing from your domain and exposes recipient data in logs. It is a long-lived secret.
How to fix it
Move the key into an environment variable and read it at runtime. Rotate the private API key in the Mailgun dashboard after removing it. Keep it off any client-side code.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo