Hard-coded secrets in JavaScript: how to find and remove them
Medium
Unspill found long, random-looking values assigned to names like secret, token, password or api_key. These are heuristic matches: some may be harmless public IDs, but each deserves a look.
Why it matters
Anything in your JavaScript bundle is public, whatever the variable is called. Minification doesn't hide strings.
Quick fix
- Look up each masked value in your code (search by the first characters shown).
- If it's a real secret: rotate it and move it server-side.
- If it's a public ID (e.g. analytics), you can ignore this finding.
Step by step
1. Identify
Search your source for the variable name and the first characters shown in the report.
2. Classify
Public identifiers (analytics IDs, publishable keys, OAuth client IDs) are fine. Anything described by the provider as secret, private or server key is not.
3. Rotate and move
Move the call that needs the key to server-side code (a Supabase Edge Function, a Vercel/Netlify function, or a Next.js API route / server action) and store the key as a server-only environment variable. In Vite apps, any variable starting with VITE_ is bundled into the browser; in Next.js, anything starting with NEXT_PUBLIC_ is.
Prompt for your AI builder
Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.
Find every hard-coded API key, token, password or secret in my front-end code and environment variables prefixed with VITE_ or NEXT_PUBLIC_. For each, tell me whether it is meant to be public. Move every non-public one to a server-side function with a server-only environment variable.FAQ
I deleted the key from my code. Am I safe now?
No. Once a key has shipped to browsers it should be treated as public. It is in old deployments, caches and anyone's saved copy of your JavaScript. Revoke it at the provider and create a new one; removing it from code only stops future leaks.
Can this be a false positive?
Yes. This check is heuristic (variable name plus randomness). Known-public values like Supabase anon keys, Firebase web keys and Stripe publishable keys are excluded, but other public IDs can still match.