Glossary
Publishable key
The newer name for a public client key. Same rule: public by design, not a permission.
What it means
A publishable key is a public identifier a service gives you for browser use. Stripe has one, Supabase has one, most platforms have one. It is designed to sit in client code where anyone can read it.
The danger is the pair it travels with. Every service that issues a publishable key also issues a secret one, and the two look similar enough that an agent copying configuration will sometimes take the wrong one. A publishable key in the bundle is normal. A secret key in the bundle is an emergency.
A check reads your client JavaScript and distinguishes the two by prefix and shape. Publishable keys are reported as nothing at all. Secret keys are reported as finding O4, with the evidence line and the date so you can act on it immediately.
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026