Are secret API keys exposed in your front end?
Secret keys in your HTML and JavaScript, such as Stripe secret keys, OpenAI and Anthropic keys, AWS keys, Supabase service role keys and private keys.
Why it matters
Anything in your page or its JavaScript can be read by anyone. A leaked secret key works for whoever finds it: refunds issued in your name, a large AI bill, or full access to your database. Automated tools search public sites for these keys all the time.
How a survey checks it
Passive check: part of every free survey.
We look through the homepage and the same-site scripts it loads for known key formats and for high-entropy values with secret-sounding names. We never use a key we find, and reports show only a masked version.
How to fix it
- Treat any exposed secret as compromised: create a new key at the provider, switch your app to it, then delete the old one.
- Move the call that needs the key to your back end, an edge function or a serverless function, so the key never reaches the browser.
- Keep publishable keys (Stripe publishable, Supabase anon, Firebase config) in the front end only, and protect your data with rules on the server side.
Prefer us to do it? Ask for a fix quote
Common questions
Is my Supabase anon key a leak?
No. The anon key is designed to be public. Your data is protected by row level security rules, not by hiding that key. A service role key is different: it bypasses those rules and must never be in the browser.
I removed the key from my code. Am I safe?
Not yet. Old versions of your site, browser caches and anyone who already copied it can still use it. Rotate the key at the provider so the old one stops working.