Leaks & secrets
A full-access service key reached the browser
Privileged service key exposed to client
What this means
Your page source contains a service key that bypasses every access rule for your database. That key belongs on the server only.
Why it matters
Such a key removes all data protection: access rules simply do not apply to it. Publishing it is equivalent to publishing your database administrator password.
How to fix it
- Revoke the key immediately — anyone who opened the page could have saved it.
- Keep only the restricted public key in the browser.
- Review database access logs for the period the key was exposed.
Prompt for your AI agent
Remove the full-access service key from client code, revoke it, and use only the restricted public key in the browser.
Verify the fix: scan the page again — the service key must be gone
Is your app doing this?
Find out in about a minute — the first scan is free.