No server side keys matched in the downloaded code

Agents copy configuration. When a service issues a public key and a secret one that look alike, the wrong one ends up in a client file, and the app keeps working perfectly, which is the problem. A scan of 5,600 vibe-coded apps found more than 400 exposed secrets this way.

The known server key patterns did not appear in the files checked. Publishable and browser keys are expected there and are ignored.

assets/index-4f2a.js contains a key beginning sb_secret_

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

Nothing to change here.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

• Observed

  5,600 vibe-coded apps scanned

  More than 2,000 vulnerabilities and more than 400 exposed secrets found across vibe-coded apps.

  2026-02

  Read the incident

• service role key
• publishable key
• anon key