Secrets and config
API key shipped in the client bundle
A key meant for the server ends up in JavaScript the browser downloads, so anyone can read it and call the service as the app.
Termsclient bundle (the JavaScript your app sends to the browser or ships inside the mobile app; anyone can read it) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · security headers (HTTP response headers (HSTS, content-type, frame policy) that switch on the browser's built-in protections) · CI (the pipeline that builds and tests every change before it can be merged or deployed)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Generated code often calls a service from wherever the feature is being written, including components that run in the browser, and the key gets pasted where the call is. A scan of 5,600 prompt-built apps found over 400 exposed secrets, and one platform incident traced full database access to a key in front-end JavaScript.
A scan of more than 5,600 publicly available applications built with prompt-to-app platforms found more than 2,000 vulnerabilities, over 400 exposed secrets, and 175 instances of exposed personal data.
Source: Escape, 2025-10-29 · verified 2026-09-21
A Supabase key exposed in client-side JavaScript combined with missing row-level security policies gave read and write access to a social platform's database: about 1.5 million API tokens, 35,000 email addresses and private messages. Reported 31 January 2026, patched within hours.
Source: Wiz Research, 2026-02-02 · verified 2026-09-21
How we detect it
Search the built client assets for key prefixes and for every value in the server environment. Confirm each hit against the provider's key type.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
No secret keys in client bundles
automated Scan the built client assets (JS, source maps, HTML) for known key prefixes and for every value present in the server environment file.
Zero matches for key prefixes (sk_, service_role, AKIA, whsec_, private keys) and zero server-only env values found in client assets.
Public environment prefix carries only public values
manual List every variable with a client-exposed prefix (NEXT_PUBLIC_, EXPO_PUBLIC_, VITE_, REACT_APP_) and confirm each one is meant to be public.
Every client-prefixed variable is documented as public; no variable holds a key that can write or read beyond the anonymous role.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in secrets and config
- critical
- critical
- high
- high
- medium
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.