The secrets hiding in your JavaScript
API keys, tokens, and credentials that shipped to the browser by accident.
Every guide in this topic
Is your Stripe secret key in your JavaScript bundle right now?
A live Stripe secret key in your frontend lets anyone refund your revenue to themselves. How it gets there, how to check in two minutes, and how to fix it.
Why is there an AWS key in your build, and who can use it?
An AKIA key in your JavaScript is one S3 call from your whole bucket. How it leaks, what a stranger does with it, and how to check from outside.
Did you leak a Supabase service_role key? (It bypasses every security rule you wrote)
The Supabase service_role key skips row-level security entirely. If it shipped to the browser, your RLS policies protect nothing. How to check and fix.
GitHub, Slack, OpenAI: which tokens end up in frontend code, and what they unlock
A leaked ghp_ token is read access to your private repos. The prefixes that end up in bundles, what each one unlocks, and how to find them.
What are source maps, and are you handing strangers your original code?
Minified means nothing if the source map ships next to it. What source maps expose in production, how to check, and how to stop serving them.
Why your "public" key is fine but your secret key is a fire
Not every key in your bundle is a problem. The ones that are, are catastrophic. How to tell which is which, and the one rule that sorts them.
An OpenAI or Anthropic key in your frontend is someone else's free compute
An sk-proj- or sk-ant- key in your JavaScript is a metered bill anyone can run up. How AI keys end up client-side, what a stranger does with one, and how to check.
GitLab, DigitalOcean, GCP: the infrastructure tokens that leak into bundles
A glpat-, dop_v1_, or service-account key in your JavaScript is keys to your infrastructure, not just one API. The prefixes that leak and what each one controls.
SendGrid, Twilio, Shopify: the SaaS keys that leak and send mail as you
An SG. SendGrid key or a Twilio SID in your JavaScript lets a stranger send email and SMS on your account and bill. The SaaS prefixes that leak and what each does.
A database connection string in your frontend is a direct line to your data
A Server=...;Password=... connection string or a PlanetScale token in your JavaScript is the database itself, not just an API. How they leak, what a stranger does with one, and how to check.
Did you leave an API key in an HTML comment?
Comments are invisible in the browser but plain text in the source. A key left in an <!-- ... --> ships to every visitor. How it happens, what a stranger does with one, and how to check.
Is there a secret in your __NEXT_DATA__? (Your SSR props ship to the browser)
Server-rendered apps serialise their state into the page so the browser can hydrate. Anything in that blob is public: __NEXT_DATA__, __PRELOADED_STATE__, Apollo, Nuxt. How a server-only key gets in there, and how to check.
Your API response is carrying password hashes, tokens, and connection strings to the browser
A fat serializer that dumps the whole database row sends the password hash, the API key, and the connection string straight to the client alongside the username. The server-only fields that ride an API response to the browser, and how to check yours.
A token a logged-out visitor can read is a token you can't trust
A JWT with alg=none, a long-lived identity token, or an AUTH_SECRET baked into your hydration state lets an attacker forge a session for any user. The auth material that leaks into HTML, and how to check.
Your live site's login is wired to Clerk's development instance
A Clerk pk_test_ publishable key is public by design, but on a production domain it means your live auth runs on the shared development instance: weaker limits, test OAuth, *.accounts.dev. How to spot it from outside, and the fix.
Your JWKS is supposed to publish public keys. Is it publishing the private one?
A JWKS endpoint is meant to serve only the public half of your token-signing keys. If a private member leaks into it, anyone can forge a valid login token for any user. How the leak happens, and how to check.
A token in your URL is a token in your CDN logs, your history, and someone's Referer
Put an access_token, session ID, or api_key in a URL and it lands in proxy logs, browser history, and the Referer header sent to third parties. Why URL credentials leak, and the fix.
Find it before someone else does.
Paste your domain. The grade and issue count are free, and you'll see in a couple of minutes exactly what's reachable from outside.
External, read-only scan. We only request public URLs - never log in, never send attack traffic.