Is a secret API key exposed in my website code?

Updated 2026-10-16

Short answer: if a secret key is written into a JavaScript file your site sends to browsers, every visitor can read it. Publishable keys are meant to be public; secret ones (a Stripe secret key, an OpenAI or AWS key, a Supabase service_role key) are not, and anyone holding one can spend money or read data as you.

How to check it yourself

  1. Open your site, then your browser's developer tools, then the Sources (or Debugger) tab.
  2. Search all loaded files for key prefixes such as sk_live_, sk-, AKIA, ghp_, xoxb- and service_role.
  3. If you find a secret key, revoke it in that provider's dashboard first, then create a new one.
  4. Move the new key to your server or hosting environment variables, and call the provider from there, never from browser code.

What Preventionlabs shows

On domains you've proven are yours, every report searches the code your homepage sends to visitors for secret keys from Stripe, OpenAI, Anthropic, AWS, GitHub, Slack and Supabase (service_role), and says which file it found one in. It reports the problem without printing the full key.

It reads the code every visitor downloads, not your server's code or repository.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free