Why it matters
Anyone can press 'View source' and copy this key, then run up your bill or read your database. Bots scan for exactly this, all day.
How to check it yourself
Right-click your live site, choose View page source, and search for sk_live_, sk-, AKIA, service_role and BEGIN PRIVATE KEY. Any hit means the key is public.
What the fix involves
Move the key to a server-only environment variable, call that API from a server route instead of the browser, and rotate the key, because deleting it from the code doesn't un-leak it.
Reference: owasp.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.