Skip to content
VibeVigil
Log inSign up

Blog · November 6, 2026

Does your API key have a public name?

If a secret key has a public prefix, anyone can read it in your site's JavaScript.

Many frameworks copy any variable with a special prefix into the code that runs in the browser. In Next.js it's NEXT_PUBLIC_. In Vite it's VITE_. AI tools sometimes add these prefixes just to make an error go away.

If a secret key has that prefix, anyone can read it in your site's JavaScript.

How to check:

  1. Open your live app and view the page source or the Sources tab in DevTools.
  2. Search the JavaScript files for sk_, secret, or service_role.
  3. Check your .env for secret keys that start with NEXT_PUBLIC_ or VITE_.

If you find one, rename it without the prefix, move that code to the server, and make a new key. Treat the old key as leaked.

VibeVigil scans your live app for exposed keys. Try it free: https://vibevigil.com

A short note. Not a promise.

If you want to know about your own site, run the free scan.

Scan a site you own. It is free. No account.

You see the report first. Saving the site is optional.

No account. The report is the next page.

Free, no account. We fetch the public page, its scripts, and a few well-known paths.

Does your API key have a public name? · VibeVigil