Agent WranglersData and secrets Required
Keep secrets out of the browser
Send no private key to the browser. Anything in a page, script or source map can be read by anyone.
How to do it
Call paid or private services from the server, and let the browser call your server. Only public keys belong in the browser, and only ones the provider marks as safe to publish. Build tools copy some environment variables into the bundle, such as those starting VITE_, NEXT_PUBLIC_ or REACT_APP_. Never give a secret such a name. Don't publish source maps to production, or keep them private.
Example
curl -s https://staging.example.com/assets/app.js | grep -Eo '(sk_live|AKIA|ghp_|xox[bp]-)[A-Za-z0-9_-]{10,}'How to check
The agent downloads every script and source map from the site and searches them for key patterns. It finds only public keys.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-browser.