https://shipreadyai.dev/learn/findings/o4-secret-none

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# No server side keys matched in the downloaded code

The known server key patterns did not appear in the files checked. Publishable and browser keys are expected there and are ignored.

## Why AI-built apps get this

Agents copy configuration. When a service issues a public key and a secret one that look alike, the wrong one ends up in a client file, and the app keeps working perfectly, which is the problem. A scan of 5,600 vibe-coded apps found more than 400 exposed secrets this way.

## Evidence line

assets/index-4f2a.js contains a key beginning sb_secret_

## The fix

Nothing to change here.

## Prompt

Keep server side keys out of client code.