Agent Wranglers

APS-61Required

Keep secrets out of the browser

Send no private key to the browser. Anything in a page, script or source map can be read by anyone.

By Agent Wranglers. Updated .

How to do it

Call paid or private services from the server, and let the browser call your server. Only public keys belong in the browser, and only ones the provider marks as safe to publish. Build tools copy some environment variables into the bundle, such as those starting VITE_, NEXT_PUBLIC_ or REACT_APP_. Never give a secret such a name. AI app builders sometimes put database service keys, payment secrets or AI provider keys in front-end code to make a feature work. Move each such call into a server or edge function, and rotate any key that has ever reached the browser. Don't publish source maps to production, or keep them private.

Examples

Shell example

curl -s https://staging.example.com/assets/app.js | grep -Eo '(sk_live|AKIA|ghp_|xox[bp]-)[A-Za-z0-9_-]{10,}'

How to check

The agent downloads every script and source map from the site and searches them for key patterns, such as sb_secret_, sk_live_ and sk-. It decodes each token that starts with eyJ and finds none with the role service_role. It finds only public keys.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/secrets-out-of-browser">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.