An access key is visible in your page source
Hardcoded secret in frontend bundle
What this means
The code your app sends to browsers contains an access key for an external service. Every visitor can see it by viewing the page source.
Why it matters
Stolen keys are used for charges, mailings and requests to your data in your name. The bill arrives at your address and the trail leads to your account.
When this is not a problem
Public keys intended for browser use are not a finding — provided access is restricted on the service side.
How to fix it
- Revoke and reissue the key: it must be treated as compromised.
- Move calls to the external service to your server, where the key stays hidden.
Prompt for your AI agent
Remove the access key from code shipped to the browser. Move the external service calls to the server and keep the key in environment variables.
How to verify the fix: scan the page again and confirm the key is gone
References: cwe.mitre.org