Skip to content

API key in your JavaScript bundle: how to find it and fix it

Security · Fix today · vibeliq reports this as “A secret key is baked into your JavaScript files”

Why it matters

Your site's JavaScript files are downloaded by every visitor, and this is where AI tools most often leave a key behind. Anyone can open the file and copy it.

How to check it yourself

Open DevTools, go to Sources, press Ctrl or Cmd+Shift+F to search all files, and look for sk_live_, sk-, service_role and AKIA. Bundled files are where AI coding tools most often leave a key.

What the fix involves

The key is in the bundle because browser code imports it or it has a NEXT_PUBLIC_ or VITE_ prefix. Move it server-side, call the API through your own route, rotate the key and rebuild.

Reference: owasp.org

How vibeliq checks it

We open your site in a real browser, click nothing, and watch what happens: which outside companies it contacts, which cookies land, what your JavaScript files contain, across up to nine of your pages. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.

Related checks

All 38 checks