- Home
- The 17 checks
- A live secret is sitting in your code
A live secret is sitting in your code
In plain English: A secret key (a password that lets your app use a paid service, like OpenAI or Stripe) is written directly in your code. Anyone who can see the code, or the JavaScript your site sends to visitors, can copy it and use it on your bill.
What happens if you ship it
Someone reads it from your repo or your JavaScript bundle, and the bill or the data breach arrives before you do.
How to fix it technical
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Fix this problem in my project: A live secret is sitting in your code. Rotate this key now, because it is already exposed. Move it to a server-side environment variable, read it only from server code, and remove it from the code. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as secret-in-code, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
How do I know if my API key is exposed?
If the key is written in a file that ships to the browser, or in a public GitHub repo, treat it as exposed. SIGSHIP points to the file and line, without printing the key itself.
Is deleting the key from my code enough?
No. Once a key has been exposed, copies may already exist. Create a new key in the provider's dashboard, delete the old one, and keep the new one in a server-side environment variable.