A secret key in your website's code
Why a password or key that ends up in your site's public code can be read by anyone, and what to do when it happens.
Your website's code runs in the visitor's browser, so the visitor's browser has to download it. Anyone can open it and read it.
That's fine for most code. It's a problem when a secret ends up in it, like a key to your payment account, your database or an AI service.
How it happens
It's rarely on purpose. A key gets pasted in while testing and never removed. A setting meant for the server is marked as public by mistake. A build tool publishes source maps, the readable version of your code, alongside the real site.
Attackers search for these keys automatically, across millions of sites. A leaked key can run up bills, read customer data or send email as you within hours.
What to do when a scan finds one
- Treat it as used. Even if you remove it now, someone may already have it.
- Replace it. Create a new key with the service that issued it, and delete the old one.
- Move it to the server. Keys belong in server settings, never in code that runs in the browser.
- Check the bills and logs of that service for anything you didn't do.
Some keys are meant to be public, like a payments form key that can only start a checkout. A scan says which kind it found and how sure it is.
Was this helpful?