Which services and settings does your app expose?
The outside services and API addresses your front-end code talks to, and the names of environment variables built into it.
Why it matters
It is a map of what an outsider can see. Most of it is normal. It matters when a variable with a secret-sounding name is built into the front end, which usually means a secret was exposed by mistake, or when the browser calls an AI provider directly, which needs a key in the browser.
How a survey checks it
Passive check: part of every free survey.
We read the addresses and variable names in your homepage and its scripts. We list names, never values.
How to fix it
- Only give the browser variables that are meant to be public. In Vite and Next.js, anything prefixed VITE_ or NEXT_PUBLIC_ ends up in the browser.
- Call AI providers such as OpenAI or Anthropic from your back end or an edge function, never straight from the browser with your key.
Prefer us to do it? Ask for a fix quote
Common questions
Why does a variable name matter if you never see its value?
Because a name like VITE_STRIPE_SECRET_KEY in the front end almost always means the value is there too. The leaked secrets check looks for the values themselves.
Is it a problem that people can see which services I use?
Not by itself. It is useful to know what your app reveals, so you can check that each service is set up safely.