A server side key appears in code the browser downloads

Agents copy configuration. When a service issues a public key and a secret one that look alike, the wrong one ends up in a client file, and the app keeps working perfectly, which is the problem. A scan of 5,600 vibe-coded apps found more than 400 exposed secrets this way.

Anyone who opens the page can read this key and use it directly against the service it belongs to, with your account paying for it.

assets/index-4f2a.js contains a key beginning sb_secret_

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

Rotate the key at the provider straight away, move the call that needs it to a server function, and remove the key from anything the browser downloads. Pattern {pattern} found in {bundle}, starting {masked}.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

• Observed

  5,600 vibe-coded apps scanned

  More than 2,000 vulnerabilities and more than 400 exposed secrets found across vibe-coded apps.

  2026-02

  Read the incident

This page is the explanation of the finding. The free tool runs the same check on your own app and returns the evidence line.

Package name check

• service role key
• publishable key
• anon key