Home / patterns

API secret keys shipped in your frontend bundle

Quick answer: Anything in client-side code is public. Env vars with NEXT_PUBLIC_ or VITE_ prefixes reach the browser, so a secret key stored there is exposed.

Last updated October 14, 2026

Steps

  1. Open your own site and go to DevTools → Sources.
  2. Search for sk_, service_role and secret.
  3. If you find one, rotate it immediately and assume it has leaked.
  4. Move the call to a server route and keep secrets in non-public env vars.

Why it matters

This is a common failure pattern in apps built quickly with AI coding tools. The steps above check your own app only. Never test apps you don't own.

Want an expert to check your app?

VibeRescue checks are coming soon. Join the waitlist, or ask StorenTech AI to fix it for you.

Join the waitlist

Vibe Security Weekly

One email a week with new failure patterns and how to fix them.

Signups open shortly. We'll never sell your email.