Secrets in the browser | What goes wrong

What it is

Your app talks to other services: a database, a payment company, an email service, an AI model. Each one gives you a key, a long string of letters and numbers that proves it’s you. Some keys are designed to be public. Most are not.

A secret key in the browser means it’s inside the part of your app that gets sent to every visitor. Anyone can open the page, look behind it, and copy the key. AI coding tools do this often, because it’s the shortest path to making a feature work.

What it looks like from your side

Usually nothing. The app works. The first sign is often a bill: an AI or email provider charging for usage you didn’t generate. Or a message from a provider saying one of your keys was found in public. Or data that changed when nobody on your team changed it.

What it costs if you ignore it

Someone runs up your bill on your keys. Someone reads your database with your own credentials. Someone sends email as you.

Every key has to be rotated in a hurry, which means downtime while everything that used them is updated. If a key was ever posted somewhere public, like a public GitHub project, assume it was copied within minutes.

How to check it yourself in 30 seconds

1Open your app in Chrome and sign in the way a customer would.
2Press F12, or Cmd+Option+I on a Mac. A panel opens showing what’s behind the page. Click the tab called Sources, which lists every file the page loaded.
3Press Ctrl+Shift+F, or Cmd+Option+F on a Mac. This searches inside all of those files at once.
4Search for sk_live. Then service_role. Then eyJ.
5sk_live is the start of a Stripe secret key. service_role is a master key for your database that skips every rule about who can see what. Either one showing up is a finding. eyJ is the start of a token, a temporary pass. One tied to your own sign-in is normal, but one sitting in the code itself is worth asking about. Keys starting with pk_live or labelled anon are designed to be public, so on their own they’re fine.

Not sure what you’re looking at? Screenshot it and send it with your booking. Reading it is part of the review.

How I fix it

The keys move out of the app and onto your server, the part of your app that users never see. The app asks the server to do the work, and the server checks who’s asking before it does.

Any key that was ever in the app gets replaced, because you have to assume it was copied. The review tells you which keys are exposed, what each one can do, and what fixing it costs.

Find out before your users do.

The Production Readiness Review is $250, takes 2–3 business days, and ends with a clear verdict: fix, restructure, or rebuild.