Agent WranglersApps built with AI builders Required
Keep secret keys on the server
Never ship a secret key in code that runs in the browser. That covers database secret or service role keys, payment secrets and AI provider keys.
How to do it
Builders sometimes place keys in front-end code to make a feature work. Move every call that needs a secret into a server function or edge function. Rotate any key that has ever reached the browser. The general rule is keep secrets out of the browser.
How to check
Download every script the live app loads and search for key patterns, such as sb_secret_, sk_live_ and sk-. Decode each token that starts with eyJ and confirm none has the role service_role. Only public keys are found.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/server-side-keys.