Checks · SEC-003

SEC-003 · Service-role or secret key in client bundle

Why it matters

Code the browser downloads is public. A service key there lets other people act as your server.

How we detect it

Public JavaScript is fetched and checked for service-role tokens and live secret key formats.

How we fix it

Move the call to a server route and rotate the key. The public anon key can stay in the browser.

Can it be fixed automatically? With review

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-002 · Secret in git history
• SEC-004 · Public env prefix on a secret
• SEC-005 · AI provider key used from browser