API Key Leaked in JavaScript Bundle

What is it?

API keys (OpenAI, Anthropic, Stripe, AWS, etc.) are embedded in client-side JavaScript, accessible to any visitor.

How to fix

Move API calls to a server-side route (Next.js API route, edge function). Never ship secret keys in client code.

Scan for this vulnerability

Security Scanner automatically checks for this issue as part of its 70+ module scan. Try it free — no signup needed for the quick scan.

Check your app now →

Related reading

• Top 5 Supabase RLS mistakes
• Beyond Supabase RLS: 5 other critical vulnerabilities
• Q2 2026 State of Vibe-Coded Security