Leaked API keys in your frontend
If a secret API key is in your frontend code, anyone can copy it. Open your site, view the JS files, and search for key patterns. If you find a secret key, make a new one, delete the old one, and move the call to a server. Hiding or scrambling the key in the browser does not make it safe.
Step-by-step checklist
- Know the difference. Some keys are meant to be public, like a Stripe publishable key (
pk_) or the Supabase anon key. Secret keys are not. - Open your live site. In DevTools, go to Sources and search all files for words like
sk_,secret,service_roleandapi_key. - Check your env files. In Vite, any
VITE_value goes to the browser. In Next.js, anyNEXT_PUBLIC_value does. - Search your repo and its history. A key removed in a later commit is still in old commits.
- For each leaked secret, rotate it: make a new key and revoke the old one in that service.
- Move the call that needs the key into a server route or edge function.
- Set spend limits or usage alerts on paid APIs like AI model providers.
FAQ
Is the Supabase anon key a leaked key?
No. It is built to be public. Your safety comes from RLS.
Can I hide a key with base64 or a minifier?
No. Anyone can undo that in seconds. If the browser can use the key, a person can too.
I deleted the key from my code. Am I safe?
Not yet. It may still be in git history or in cached files. Rotate the key.
Does DeployVet find leaked keys?
Yes. The Free check scans your public JS files for secret-looking keys.
What does a full scan cost?
A Scan is $7 once. Pro is $15/mo for weekly scans. The Free check is $0.
Check your app for free
DeployVet scans your live site from the outside, like a stranger would. You get a score and the worst issue with a fix.
DeployVet has three plans. The Free check is $0. A one-time Scan is $7. Pro is $15/mo and adds weekly scans and email alerts. For paid plans you pay first, then the scan runs.