Why it matters
Your site's JavaScript files are downloaded by every visitor, and this is where AI tools most often leave a key behind. Anyone can open the file and copy it.
How to check it yourself
Open DevTools, go to Sources, press Ctrl or Cmd+Shift+F to search all files, and look for sk_live_, sk-, service_role and AKIA. Bundled files are where AI coding tools most often leave a key.
What the fix involves
The key is in the bundle because browser code imports it or it has a NEXT_PUBLIC_ or VITE_ prefix. Move it server-side, call the API through your own route, rotate the key and rebuild.
Reference: owasp.org
How vibeliq checks it
We open your site in a real browser, click nothing, and watch what happens: which outside companies it contacts, which cookies land, what your JavaScript files contain, across up to nine of your pages. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.