When you ask an AI to "connect my app to Stripe/OpenAI/Supabase", it often drops the key straight into the frontend code. The problem: everything that reaches the browser is public. Anyone can read it.
How an attacker sees it
Open DevTools (F12) → "Network" or "Sources" tab, and search for strings like sk_live_, AKIA or eyJ.... If your secret key is there, they already have it.
Which keys are dangerous
- Secret keys (Stripe
sk_live, OpenAI, AWS): must never leave the server. - Supabase's service_role: it bypasses all your database security. Never in the frontend.
- Access tokens stored in
localStorage: stealable with a simple XSS.
The golden rule
Secret keys live on the server (environment variables, serverless functions). The frontend only uses public keys meant for it (like Supabase's anon key, protected by RLS).
How to check
Scanaris scans your site's JavaScript and warns you if it detects exposed API keys or secrets — before someone else does.