What it looks like
An API key, a database connection string or the original prompt sitting in the page’s JavaScript bundle, in an HTML comment, or in a config file served next to the page. Sometimes the text that generated the site is still in the source, instructions to the model and all.
Why it gives a page away
Generated apps ship their keys because the model put them where it put everything else, and nobody with technical judgment reviewed the output before it went live. That makes it a smoking gun on its own. It is also a security problem for the owner and often for the owner’s customers: security researchers who audited vibe-coded apps found exposed keys and open databases to be common, not rare. An entry says what kind of secret was found and never prints it.
How to check your own site
Open the page source and the network tab, and search for “key”, “secret”, “token”, “password”, “sk_”, “pk_”, “supabase” and “api”. Anything that looks like a credential is one. Then rotate it today, before fixing the page, because it has been public since launch.
What a designer would do instead
This one is for the developer: keys live on the server or in a vault, never in the browser bundle, and a published site is read through once by a person who knows what a credential looks like. The prompt is deleted from the repository before anything ships.
When it is not a tell
A public key that is meant to be in the browser, such as a map key restricted to the domain. The entry checks what the key can do before it counts it.
Sources
Other tells in interaction and technology
- "Built with" badge left on: A floating "Edit with Lovable", "Made in Framer", "Built with Durable" or "Made in Webflow" badge that the free plan adds and the owner never removed.
- A form that submits to nothing: A contact or sign-up form with no action, no handler, or a success message that appears whatever you type.
- A template nobody customised: The demo template's structure, section order, placeholder image ratios and sample headings are all still there, with only the words changed.
- Buttons that go nowhere: Primary buttons linking to "#", navigation items that reload the home page, a "Learn more" that learns nothing.
- Default favicon: The browser tab shows the builder's icon, the framework's logo, or nothing.
- Errors in the console: The browser console shows failed requests, missing images or script errors on the home page.
- Published on the builder's domain: The site lives at something.lovable.app, bolt.host, replit.app, framer.website, durable.site, webflow.io or godaddysites.com, with no domain of its own.
Score a site against every tell in Interaction and technology