Exposed API Keys & Secrets
Credentials such as AWS access keys, Stripe live keys, GitHub tokens and private keys sometimes ship to the browser inside HTML or bundled JavaScript, where anyone can read them.
Why It Matters
A leaked key is an immediate compromise, not a theoretical one: automated scanners harvest public pages for key patterns within minutes of publication. Depending on the key, an attacker gets your cloud account, your payment data, or your source repositories — no exploit required.
How We Check
We match your served HTML and inline scripts against signatures for well-known credential formats — AWS `AKIA…` access key IDs, `sk_live_`/`pk_live_` Stripe keys, GitHub `ghp_`/`github_pat_` tokens, Google `AIza…` API keys, Slack `xox…` tokens, SendGrid keys and PEM private-key blocks.
How to Fix
Revoke and rotate every exposed credential first — removing it from the page does not un-leak it. Move secrets to server-side environment variables and expose only public, origin-restricted keys to the browser. Add a secret scanner (gitleaks, GitHub secret scanning) to CI so the next one never reaches production.
Frequently Asked Questions
What is Exposed API Keys & Secrets?
Credentials such as AWS access keys, Stripe live keys, GitHub tokens and private keys sometimes ship to the browser inside HTML or bundled JavaScript, where anyone can read them.
Why does Exposed API Keys & Secrets matter for website security?
A leaked key is an immediate compromise, not a theoretical one: automated scanners harvest public pages for key patterns within minutes of publication. Depending on the key, an attacker gets your cloud account, your payment data, or your source repositories — no exploit required.
How do I fix Exposed API Keys & Secrets issues?
Revoke and rotate every exposed credential first — removing it from the page does not un-leak it. Move secrets to server-side environment variables and expose only public, origin-restricted keys to the browser. Add a secret scanner (gitleaks, GitHub secret scanning) to CI so the next one never reaches production.
Related Security Checks
Check Your Website Now
Run a free security scan to check for Exposed API Keys & Secrets issues and 62+ other security vulnerabilities.
Scan Your Website Free