API key

A publishable key is expected to be visible. Its power is bounded by server-side restrictions: which origins may use it, which operations it permits, what it may spend.

A private key carries the account's full authority. It is meant to live on a server and is restricted only by being secret.

They frequently look alike — same vendor, similar length — and differ by a prefix. Most services adopted that prefix convention precisely because the mistake was so common.

Which is why reading the prefix is the first step on any key found in a served file, before deciding whether it is a finding at all.

A value is needed at build time. The build fails because the variable is not exposed to the browser context.

Adding the public prefix makes the build succeed, and the running site looks identical.

Or a server-side call is moved to the client during a refactor, and the credential it used moves with it.

Or the key is committed to a repository, deleted later, and remains in the history — which is public if the repository is.

None of these produce a visible symptom, which is why they survive until someone reads the served files.

A key served publicly has been readable for an unknown period by an unknown number of readers.

Removing it from the bundle stops future exposure and does nothing about copies already taken.

So the sequence is: issue a new key, deploy with it, revoke the old one, and only then tidy the code.

Doing it in the other order leaves a window where the old key is still valid and the new one is not yet live.

Where the key was in repository history, rewriting that history is a separate and much larger operation — and revoking the key is what actually removes the risk.

Served scripts and stylesheets are read for strings matching known credential formats, within the scan budget.

Publishable keys are reported separately as information, because flagging them as leaks would be a false alarm that teaches people to ignore the check.

Nothing found is stored or reproduced beyond what identifies where it is.

Detection is by pattern, so an unusual format may not be recognised — which is why the coverage figure is reported alongside, and why secret scanning in the build pipeline catches what an external read cannot.