Leaked API keys in the client bundle
Secret keys that an AI coding tool left inside JavaScript the browser downloads.
Who this is for
Anyone who pasted a secret into a chat and shipped the result.
What AppPulse does
The free scan downloads the public homepage and the script files it references, then looks for known secret shapes: Stripe secret keys, Supabase service-role keys, cloud tokens, and private key blocks. Values in the report are shortened.
Why it matters
A secret in a bundle is already public. Rotate it, then move the call to a server route that is not shipped to the browser.
What to tell your AI tool
Ask your AI tool to move the secret into a server-only environment variable, delete it from any NEXT_PUBLIC or VITE variable, and rotate the key in the provider dashboard.