Matan · Security · Content
Secrets in page source
API keys and tokens must not appear in HTML or inline JavaScript.
Pass condition in our engine: No high-confidence secret patterns in the HTML.
1. Problem description
We scan conservatively for AWS keys, Google API keys, Stripe secret keys, GitHub tokens, PEM blocks and assignment-like secret= patterns. False positives are possible; false negatives are too. Rotate anything we flag.
2. Most common causes
- A frontend .env bundled into the browser build.
- A commented-out key left in the template.
- Maps API key unrestricted in a script URL (related issue).
3. How to fix it
- Move secrets to the server.
- Rotate exposed keys immediately.
- Use publishable/public keys only in the browser, with HTTP referrer restrictions.
Test this check
We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.
Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.
Get your free SEO & GEO report
Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.