https://shipreadyai.dev/learn/findings/o4-secret-in-bundle

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# A server side key appears in code the browser downloads

Anyone who opens the page can read this key and use it directly against the service it belongs to, with your account paying for it.

## Why AI-built apps get this

Agents copy configuration. When a service issues a public key and a secret one that look alike, the wrong one ends up in a client file, and the app keeps working perfectly, which is the problem. A scan of 5,600 vibe-coded apps found more than 400 exposed secrets this way.

## Evidence line

assets/index-4f2a.js contains a key beginning sb_secret_

## The fix

Rotate the key at the provider straight away, move the call that needs it to a server function, and remove the key from anything the browser downloads. Pattern {pattern} found in {bundle}, starting {masked}.

## Prompt

A server-side secret ({pattern}) is inside the JavaScript sent to browsers. Rotate it at the provider now, move the code that uses it to your server, and remove it from any frontend environment variable.