Secrets
You found an exposed API key. Here is what to actually do.
First, do not panic: some API keys are designed to be public and are safe in your front end. Others are true secrets that must be rotated the moment they leak. The right response depends entirely on which kind you found, so the first job is to tell them apart.
Not every visible key is a leak.
People find a key in their page source or repo and either panic over a key that was always meant to be public, or shrug at one that grants real power. Both mistakes are common and both are costly: wasted effort on a non-issue, or a genuine secret left live. The exposure that matters is not whether a key is visible. It is what the visible key can do.
Keys that are meant to be public
Some keys are publishable by design and are safe to ship in client code. A Supabase anon key, a Firebase config API key, a Stripe publishable key and most analytics keys fall here. They identify your project to a service and rely on other controls, row-level security, Firebase rules, server-side confirmation, to keep data safe. Finding one in your page source is expected, not an incident.
The catch is that a public key is only as safe as the controls behind it. A Supabase anon key is fine with row-level security on and dangerous without it. So when you find a public key, the question is not hide it, it is what protects the data this key can reach.
Keys that must be rotated immediately
Secret keys grant real power and must never reach the browser. A Supabase service role key, a Stripe secret key, a server-side API key for a paid service, database credentials, a private token: if any of these appear in client code, a public repo or your git history, treat them as compromised and rotate them now. Rotation issues a new key and instantly invalidates the exposed one.
Rotating is not the whole job. After rotating, update every server that used the old key, then work out what the exposed key could have done while it was live, run up charges, read data, send messages, and check whether any of that happened.
How to tell which kind you have
Look up the specific key type in its provider's documentation; every major service states plainly whether a given key is publishable or secret. As a rule of thumb, keys labelled publishable, public, anon or client are meant to be seen, and keys labelled secret, service role, private or server are not. If a key can charge money, send email, or read all users' data on its own, it is a secret regardless of its name.
If you genuinely cannot tell, rotate it. Rotation is cheap and safe, and a needless rotation costs you a few minutes, while a missed secret can cost a great deal more.
Common questions.
- My API key is in my JavaScript bundle. Is that bad?
- It depends on the key. Publishable keys like a Supabase anon key or Stripe publishable key are meant to be there. Secret keys never should be. Identify the key type first; that single fact decides whether this is a non-issue or an urgent rotation.
- I rotated the key. Am I done?
- Rotation stops further misuse, but also update every service that used the old key and review what the exposed key could have done while it was live. For a secret key, that review matters as much as the rotation.
- Can you find every exposed key in my app?
- Yes. Our security audit checks what ships to the browser, what is in your repo history, and what each exposed credential can actually do, then tells you which to rotate and which are safe.
Related services.
Let's build something real.
Tell us about your app or idea. You'll get a clear plan and a fixed quote back within 24 hours.