Guide
Are my API keys safe in the browser?
Publishable keys are safe in the browser by design, but secret keys, service-role keys, and live payment keys never are, and AI builders sometimes ship them anyway. If a secret key is in your app's JavaScript, anyone can extract it and use it, so the check is to look at what actually shipped in your bundle.
The difference that matters
Every key is either publishable or secret. Publishable keys, like a Supabase anon key or a Stripe publishable key, are meant to be seen and are useless on their own if your other rules are set. Secret keys, like a Supabase service-role key, a Stripe secret key, or a cloud provider key, grant real power and must stay on the server. The mistake is copying a secret key into frontend code because it made something work.
Anything in your shipped JavaScript is downloadable and searchable.
How a leaked key gets used
Anything in your shipped JavaScript is downloadable and searchable. Attackers run automated tools that scan public bundles for key patterns. A leaked service-role key lets them bypass your database rules entirely. A leaked payment key lets them act as your account. There is no way to hide a key that is in client code, so the only fix is to move it.
How to check and fix
- Scan your live app to see whether any secret-shaped key shipped in the bundle.
- Move every secret into server-side environment variables and call it from your backend, never the browser.
- Rotate any key that was ever exposed, because assume it is already collected.
Plaintext reads your bundle and flags keys that look secret, so you find them before an automated scanner does.
Frequently asked
Is it safe to put an API key in frontend code?
Only if it is a publishable key meant for the browser, like a Supabase anon key. Secret keys, service-role keys, and live payment keys must never go in frontend code, because anyone can read them out of the shipped JavaScript.
What happens if my secret key is exposed?
Anyone can use it with your privileges. A leaked service-role key bypasses your database rules; a leaked payment key can move money. Rotate the key immediately and move it server-side, since anything in client code is already collectable.
How do I find exposed keys in my app?
Scan your live URL. A passive scanner reads the shipped JavaScript and flags strings that match known secret-key patterns, which is the same method attackers use, so you catch them first.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes AI code generators leave open. The first scan is free.
Scan my app