Is a private API key sitting in your site code?

The secret key check reads the pages, scripts and source maps anyone can download for text shaped like a private key for a known service, such as an AI, payments or email provider. The key is never tried.

What does this check look at?

It looks at whether pages, scripts or source maps anyone can download hold text shaped like a private key for a known service. Your website's code runs in the visitor's browser, so the visitor's browser has to download it. Anyone can open it and read it.

Not every key in browser code is a secret. Some keys are meant to be public, like a payments form key that can only start a checkout, and a Supabase anon key only reaches what Row Level Security allows.

Pulse and Deep scans both run it.

What does a result mean?

The key is never tried, so the scan cannot tell whether it is live or what it reaches. A key built to be public, like a Supabase anon key, is not a secret. The matched value is never stored, so the evidence names the file and the kind of key, not the key itself. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

Fix this first when it is confirmed. Anyone could use a finding of this kind on their own, with no victim and no second step. Confidence starts at medium, because it rests on a pattern in your content. The report lists what to fix by how directly someone could use it, not by the severity label. Replacing the key matters more than deleting it from your code. Deleting only stops new copies.

What does a confirmed finding have to show?

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

Rotate first, then fix the code, so the old key stops working even if someone already copied it.

My site exposes a private key in browser code: [paste the key type and file from the report]. First tell me how to revoke this key and create a new one with its provider. Then move every call that uses it into a server-side route or function, so the browser calls my server and only my server holds the key in an environment variable without a public prefix (no NEXT_PUBLIC_ or VITE_). Show me the changes and check no other private key is left in client code.

After you deploy, check the provider activity log for use you do not recognise.

How to check

Say Atlas, our example app at atlas.example, calls an AI provider straight from the browser with a secret key in its bundle. The check names the script and the provider, and the fix moves the call behind an Atlas server route.

The free quick check covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. Pulse or Deep explains the difference.