Category 1 of 10
Secrets and config
Keys, tokens and environment values stay on the server and out of the repository; production runs with production settings.
v1.0 · verified on 2026-09-21
Keys leak through the client bundle, the repository history and copied configuration. These items are automated where a scanner can do the work and read by a person where judgement is needed.
No secret keys in client bundles
automated Scan the built client assets (JS, source maps, HTML) for known key prefixes and for every value present in the server environment file.
Zero matches for key prefixes (sk_, service_role, AKIA, whsec_, private keys) and zero server-only env values found in client assets.
No secrets in repository history
tool Run a secret scanner (gitleaks or equivalent) over the full git history, not only the working tree.
Scanner reports zero unrevoked findings; any historical finding has a rotation record.
Public environment prefix carries only public values
manual List every variable with a client-exposed prefix (NEXT_PUBLIC_, EXPO_PUBLIC_, VITE_, REACT_APP_) and confirm each one is meant to be public.
Every client-prefixed variable is documented as public; no variable holds a key that can write or read beyond the anonymous role.
Production runs with production configuration
manual Compare the production environment against a written list: debug flags off, test-mode API keys absent, sample data seeding disabled, verbose logging off.
Every entry on the production configuration list matches; no test-mode key or debug flag is present.
Security headers present on production responses
automated Request the home page, the app shell and one API route in production and read the response headers.
Strict-Transport-Security, X-Content-Type-Options: nosniff and a frame policy (frame-ancestors or X-Frame-Options) are present on every checked response; a CSP is present or its absence is recorded as a finding.
Dots: Starter, Growth, Scale. Compare plan limits.
Failure patterns these items catch
- criticalAPI key shipped in the client bundle
A key meant for the server ends up in JavaScript the browser downloads, so anyone can read it and call the service as the app.
- criticalService-role key used from the front end
The database's bypass-everything key is used in client code, so row-level rules no longer protect anything.
- criticalSecret committed to the repository
A key or token is in git history, where it stays readable to anyone with repository access even after the file changes.
- highPrivate value under a public environment prefix
A variable named with the framework's public prefix is inlined into the client, even though its value should have stayed private.
- highDebug or test-mode configuration reaches production
Test-mode payment keys, verbose logging or seed data run in production because the configuration was copied from development.
- mediumSecurity headers absent on production responses
Responses ship without HSTS, content-type or frame policies, leaving the browser's built-in protections switched off.
Ask which plan runs these items
Email with your team size, cadence and stacks. We reply within 24 hours on business days.